rootpwn

high · CVSS v3 8.1 · CVSS v4 8.6

CVE-2026-93758

An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a …

Description

An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges to reference a record identifier that is not their own. Processing such a request can cause that record to be looked up without the usual ownership or scoping restrictions, then updated and linked to the requesting user's own record. This may result in unintended disclosure and unauthorized modification of data belonging to other users of the application.

Scores

Severity
high
CVSS v2
8.5
CVSS v3
8.1
CVSS v4
8.6
EPSS
—

← All CVEs

Related CVEs

high

CVE-2026-93455

django-page-cms through version 2.0.13 contains an authorization bypass vulnerability in its admin helper views. The flaw allows low-privilege staff accounts to read unpublished drafts, page listings, and stored media paths without proper permission validation. This matters because it exposes sensitive organizational content to internal users who should not have access.

View analysis

high

CVE-2026-52727

The lxc-ci project inadvertently included a static pacman local-signing private key within Arch Linux container and virtual machine images built prior to May 28, 2026. This allows a malicious or compromised package mirror to issue cryptographically trusted packages to clients. Consequently, attackers can achieve arbitrary code execution as root on affected systems.

View analysis

high

CVE-2026-93563

CVE-2026-93563 is a high‑severity denial‑of‑service vulnerability in the SmtpResponseDecoder component. The flaw allows an attacker to send an unbounded number of multi‑line SMTP responses, causing the decoder to accumulate data until memory exhaustion. This can disrupt mail services and degrade availability.

View analysis

high

CVE-2026-93566

### Summary Netty skips strict chunk size line validation when the line has no chunk extension (`;`), so a chunk size line containing an embedded bare CR (e.g. `0\rX`) is accepted instead of rejected, enabling HTTP request smuggling. ### Details `io.netty.handler.codec.http.HttpObjectDecoder#checkChunkExtensions` only runs the strict validator `HttpChunkLineValidatingByteProcessor` when a `;` is present: ```java int extensionsStart = line.bytesBefore((byte) ';'); if (extensionsStart == -1) { return; } ``` According to RFC 9112 https://datatracker.ietf.org/doc/html/rfc9112#appendix-A `chunk-size = 1*HEXDIG` ### PoC ```java @Test public void test() { String requestStr = "POST / HTTP/1.1\r\n" + "Host: localhost\r\n" + "Transfer-Encoding: chunked\r\n\r\n" + "0\rX\r\n" + "\r\n" + "GET /smuggled HTTP/1.1\r\n" + "Host: localhost\r\n" + "Content-Length: 0\r\n" + "\r\n"; EmbeddedChannel channel = new EmbeddedChannel(new HttpRequestDecoder()); assertTrue(channel.writeInbound(Unpooled.copiedBuffer(requestStr, Ch

View analysis