CVE-2026-90458
OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service.
CVSS
5.4
Medio
EPSS
0.3%
p20
KEV
—
Exploit Today
6
0-100
Publicado: 23 oct 2026 · Última mod.: 23 oct 2026 · CWE-1287
0.3%EPSS · 30 días0.3%
2026-10-232026-10-25
OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1153834.8 MED7.9%
——2Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains an improper validation vulnerability that accepts components whose core modules import WebAssembly tags with a subtype of the original type. Malicious guests can mis-type exception object payloads to corrupt the GC heap, causing Wasmtime to panic when the exceptions proposal is enabled.3dCVE-2026-114509—52.8%
——16Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.4dCVE-2026-1108577.5 ALT35.7%
——11GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.ls_remote forwards URLs without check_unsafe_protocols validation. Attackers can supply ext:: remote-helper URLs to execute commands when git permits the ext transport, while merge_base and IndexFile.move also accept unguarded option injection.10dCVE-2026-978017.5 ALT54.1%
——16Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to perform tampering over a network.12dCVE-2026-960448.8 ALT57.8%
——17No cwe for this issue in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.9dCVE-2026-780163.1 BAJ5.0%
——2Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Validation of Specified Type of Input vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure and Information tampering.12d