CVE-2026-102362 mall4j through 4.0 Missing Authentication in Product Review Deletion

mall4j through 4.0 fails to implement authentication controls on the DELETE /prodComm endpoint in ProdCommController. Unauthenticated attackers can delete arbitrary product reviews by supplying the prodCommId parameter without authorization checks...

CVE-2026-102361 mall4j through 4.0 Missing Authentication in Password Update Endpoint

mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that allows unauthenticated attackers to reset any storefront account password. Attackers can supply a target username in the request body to overwrite passwords without verification, enabling...

CVE-2026-102361 mall4j through 4.0 Missing Authentication in Password Update Endpoint

mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that allows unauthenticated attackers to reset any storefront account password. Attackers can supply a target username in the request body to overwrite passwords without verification, enabling...

CVE-2026-102362 mall4j through 4.0 Missing Authentication in Product Review Deletion

mall4j through 4.0 fails to implement authentication controls on the DELETE /prodComm endpoint in ProdCommController. Unauthenticated attackers can delete arbitrary product reviews by supplying the prodCommId parameter without authorization checks...

CVE-2026-102362

The mall4j framework, version 4.0 and below , contains a vulnerability where the DELETE /prodComm endpoint in ProdCommController lacks proper authentication controls. This flaw allows unauthenticated attackers to delete arbitrary product reviews by providing a prodCommId parameter without undergo...

CVE-2026-102362 mall4j through 4.0 Missing Authentication in Product Review Deletion

mall4j through 4.0 fails to implement authentication controls on the DELETE /prodComm endpoint in ProdCommController. Unauthenticated attackers can delete arbitrary product reviews by supplying the prodCommId parameter without authorization checks...

CVE-2026-102361

The mall4j software, version through 4.0 , is vulnerable to a missing authentication flaw in the PUT /user/updatePwd endpoint. This vulnerability allows unauthenticated attackers to reset the password of any storefront account by providing a target username in the request body without verificatio...

CVE-2026-102332

Dozzle versions before 11.1.2 fail to sanitize container display names when building ZIP archive entry names in the log download endpoint. Attackers who can label containers can use path traversal sequences to write files outside the extraction directory when users download and extract logs...

NetLogic

NetLogic クラウドネイティブ攻撃面マッパー＆脆弱性相関ツール — v3.0 NetLogicは、アクティブポートスキャン、CVE相関（ライブNVD API）、SSL/TLS分析、HTTPセキュリティ監査、DNS/メールセキュリティ評価、サブドメイン乗っ取り検出、パッシブOSINT、アクティブ脆弱性プロービング、AI駆動の推論エンジン、クロスホスト攻撃チェーン発見、ディーププローブエージェントアーキテクチャを組み合わせたネットワークセキュリティプラットフォームであり、Webアプリ （Reactダッシュボード＋FastAPI）として提供されます。コアスキャンエンジンは純粋なPytho...

CVE-2026-98021

A flaw was found in the Linux kernel. A local user can cause a Denial of Service DoS by triggering excessive memory consumption on the host. When creating or updating network interfaces through the routing netlink rtnetlink interface, the kernel fails to validate and enforce maximum limits on the...

CVE-2026-5118

🔥 CVE-2026-5118 Divi Form Builder 一个隐藏字段。一个被篡改的值。获得整个网站的完全访问权限。 🧨 攻击者能做什么？ 能力| 影响 ---|--- 🔑 无需登录创建管理员账户| 整站接管 📦 访问 WooCommerce 客户数据| 数据泄露 💉 编辑插件/主题文件（PHP）| 远程代码执行 🕳️ 创建隐藏后门| 持久化访问 👥 查看所有用户数据| 侵犯隐私 🔬 漏洞分析 漏洞位置 includes/shared/handlers/FormSubmissionHandler.php → createuser 漏洞代码 // Baris 1691: Ambil...

ANT-2026-Y9CTVKPP · jetty/jetty.project · Denial of Service / Resource Exhaustion

denial-of-service high GHSA-85fq-fc5f-7j7g Severity Claude high · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics. ANT-2026-Y9CTVKPP: WebSocket reserved opcode...

CVE-2026-102332 Dozzle before 11.1.2 Path Traversal via Log ZIP Download

Dozzle versions before 11.1.2 fail to sanitize container display names when building ZIP archive entry names in the log download endpoint. Attackers who can label containers can use path traversal sequences to write files outside the extraction directory when users download and extract logs...

CVE-2026-102332

Dozzle versions prior to 11.1.2 are vulnerable to a path traversal flaw in the log download endpoint. The issue occurs because the software fails to sanitize container display names when constructing ZIP archive entry names. An attacker capable of labeling containers can inject path traversal seq...

CVE-2026-102332 Dozzle before 11.1.2 Path Traversal via Log ZIP Download

Dozzle versions before 11.1.2 fail to sanitize container display names when building ZIP archive entry names in the log download endpoint. Attackers who can label containers can use path traversal sequences to write files outside the extraction directory when users download and extract logs...

CVE-2026-102332 Dozzle before 11.1.2 Path Traversal via Log ZIP Download

Dozzle versions before 11.1.2 fail to sanitize container display names when building ZIP archive entry names in the log download endpoint. Attackers who can label containers can use path traversal sequences to write files outside the extraction directory when users download and extract logs...

CVE-2026-102281

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.2.4 and 12.0.2, a single message with a deeply nested object in its pattern can terminate a NestJS microservice using the TCP or RabbitMQ transport. ServerTCPhandleMessage and ServerRMQhandleMessage pass a...

CVE-2026-102297

ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint. Authenticated users with Events view permission can call the frames API to list frame records from monitors they are denied access to, disclosing event and frame metadata across monitor...

DEBIAN-CVE-2026-102297

ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint. Authenticated users with Events view permission can call the frames API to list frame records from monitors they are denied access to, disclosing event and frame metadata across monitor...

CVE-2026-101092

SiYuan before v3.8.4 fails to enforce publish-access checks in the getCurrentAttrViewImages endpoint, allowing publish readers to retrieve image asset paths from unauthorized databases. Attackers can call the endpoint with an unrendered database identifier obtained through related endpoints to le...