63743 matches found
PT-2026-96159
Name of the Vulnerable Software and Affected Versions draw.io versions prior to 30.2.7 Description The OAuth callback handler in src/main/java/com/mxgraph/online/AbsAuth.java fails to compare stateToken and cookieToken when IS GAE is false, impacting self-hosted Docker and WAR deployments. This...
CVE-2026-79317
A session invalidation flaw exists in x-ui 0.3.2 because the full user object is stored in a client-side signed cookie . The application's authentication mechanism only verifies that a user object can be retrieved from the cookie without re-validating against the database or checking a session ve...
CVE-2026-79317
A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only checks that a user object can be retrieved from the cookie without re-validating against the database or any session version. When an administrator changes the...
Linux Distros Unpatched Vulnerability : CVE-2026-93748
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticate...
EulerOS Virtualization 2.10.1 : python-requests (EulerOS-SA-2026-3850)
According to the versions of the python-requests packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made...
EulerOS Virtualization 2.10.0 : python-requests (EulerOS-SA-2026-3884)
According to the versions of the python-requests packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made...
Exploit for CVE-2026-77812
CVE-2026-77812 — DJI Cleartext BLE Transmission of Wi-Fi PSK a...
BIT-ZOOKEEPER-2026-79993 Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode
The deleteContainer opcode 0x14/20 is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. This opcode is considered internal-only and the official clie...
CVE-2026-88824
The Master Blocks WordPress plugin versions before 1.5.0 (specifically 1.4.1-1.4.1.4 ) contains an unauthenticated Stored XSS vulnerability. The root cause is a lack of authorization on one of its REST routes , which allows unauthenticated users to update plugin settings. A specific value updated...
SUSE CVE-2026-89788
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix tree connection use-after-free in smb2treeconnect ksmbdtreeconnconnect publishes a new tree connection in sess-treeconns with a single reference and returns its pointer to smb2treeconnect. The handler continues to...
[slackware-security] stunnel
New stunnel packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/stunnel-5.82-i586-1slack15.0.txz: Upgraded. This update fixes security issues: Fixed truncation and out-of-bounds reads when inheriti...
CVE-2026-75878
IBM Sterling File Gateway could allow a remote attacker to bypass authentication and obtain a fully authenticated session due to improper authentication via an unvalidated SSO header...
Improper Authorization
Overview Affected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client max-stale directives. An unauthenticated attacker can request the same URL with a large max-stale value to retrieve cached responses...
CVE-2026-75878 IBM Sterling File Gateway is Vulnerable to Authentication Bypass
IBM Sterling File Gateway could allow a remote attacker to bypass authentication and obtain a fully authenticated session due to improper authentication via an unvalidated SSO header...
CVE-2026-75878
IBM Sterling File Gateway versions 6.2.0.0 through 6.2.0.6_1, 6.2.1.0 through 6.2.1.2, and 6.2.2.0 through 6.2.2.1 allow a remote attacker to bypass authentication and obtain a fully authenticated session by sending an unvalidated SSO header (CWE-287: Improper Authentication). The vulnerability i...
CVE-2026-75878 IBM Sterling File Gateway is Vulnerable to Authentication Bypass
IBM Sterling File Gateway could allow a remote attacker to bypass authentication and obtain a fully authenticated session due to improper authentication via an unvalidated SSO header...
EUVD-2026-83300
IBM Sterling File Gateway could allow a remote attacker to bypass authentication and obtain a fully authenticated session due to improper authentication via an unvalidated SSO header...
http-cache-semantics max-stale handling can disclose cross-user cached responses
http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to...
CVE-2026-92701
Cocos AI is a confidential computing system for AI. In Cocos AI 0.8.2 and earlier, VerifTeeAttestation in the Intel TDX aTLS verifier receives an expected current-session value but does not apply it to TdQuoteBodyPolicy.ReportData before validating TDX QuoteV4 evidence. The verifier can...
CVE-2026-81181
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, the password authentication flow for protected shared notes does not rotate the session identifier after successful authentication, allowing session fixation. An attacker who can obtain an unauthenticated SysReptor...