CVE-2026-75037

HighCVSS 7.0/10Last modified Sep 28, 2026

Description

Polkit Authentication Based on UnixProcessSubject / Peer PID in LACT on Linux allows an Authentication Bypass. This issue affects LACT through 0.10.0. Fixed by commit d0478fe42c2219454e272f96b1cbd29ab37ee566.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-290

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Aug 25, 2026
Last modified
Sep 28, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-750386.1UNIX symbolic link (symlink) following vulnerability in ilya-zlobintsev/LACT allows for local denial-of-service. This issue affects LACT: thCVE-2026-75048.1A flaw was found in Keycloak's URL validation logic during redirect operations. By crafting a malicious request, an attacker could bypass vaCVE-2026-750448.1In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitCVE-2026-750459.1In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shaCVE-2026-750464.3In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpointCVE-2026-750476.5In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpointCVE-2026-750488.2In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possibleCVE-2026-750496.5In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the drCVE-2026-75057.3A flaw has been found in nextlevelbuilder GoClaw and GoClaw Lite up to 3.8.5. This affects an unknown function of the component RPC Handler.CVE-2026-750506.5In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parametersCVE-2026-750518.1In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possibleCVE-2026-750524.4In JetBrains IntelliJ IDEA before 2026.2.1 command execution via crafted Markdown preview content was possible in trusted projects
CVE-2026-75037: High severity, CVSS 7.0 | Vulnix