HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-63727 — Anchore Enterprise versions from 5.11.0 to 5.27.1 and 6.0.0 contain an improper ...

·Source: NIST NVD

Updated:

Executive Summary

Anchore Enterprise versions from 5.11.0 to 5.27.1 and 6.0.0 contain an improper privilege escalation vulnerability in the user management API. An authenticated attacker who is able to access the Anchore Enterprise API could issue an API call capable of modifying user permissions to gain access to additional resources and operations. It is not possible to grant the system-admin role, but a read onl

Analysis

Anchore Enterprise versions from 5.11.0 to 5.27.1 and 6.0.0 contain an improper privilege escalation vulnerability in the user management API. An authenticated attacker who is able to access the Anchore Enterprise API could issue an API call capable of modifying user permissions to gain access to additional resources and operations. It is not possible to grant the system-admin role, but a read only user could be granted write access. This issue is fixed in Anchore Enterprise 5.27.2 and 6.0.1. CVSS Score: 8.8. Published: 2026-07-28T15:17:26.063.

Indicators of Compromise (1)

CVE (1)
CVE-2026-63727
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 28, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

House Committee Advances Bill Preventing OSHA From Implementing Heat Standard

A bill that seeks to prohibit the Department of Labor’s Occupational Safety and Health Administration (OSHA) from issuing a standard […] The post House Committee Advances Bill Preventing OSHA From Implementing Heat Standard appeared first on The HIPAA Journal .

HIPAA Journal
HIGHVulnerabilityNEW

NVD HIGH: CVE-2026-67181 — Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability tha...

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize HTTP message boundaries by exploiting improper header forwarding in the proxy implementation. The proxy in src/proxy.rs forwards the client's Transfer-Encoding header to upstream backends unchanged while transmitting a body already de-chunked by tiny_http, enabling CL.TE desyn

CVE-2026-67181
NIST NVD
HIGHVulnerabilityNEW

NVD HIGH: CVE-2026-66754 — Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the ...

Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::remove_prefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL. Attackers can send a request whose decoded path matches a configured prefix while the raw percent-encoded path does not, causing the assert! to fail and triggering either a 500 erro

CVE-2026-66754
NIST NVD