CVE-2026-72920

CVE-2026-72920 affects SeaweedFS before version 4.24. The SeaweedIdentityAccessManagement gRPC service is registered without mandatory authentication when jwt.filer_signing.key is unset, allowing any client able to reach the filer’s gRPC port to invoke CreateUser, CreateAccessKey, PutPolicy, and ...

EUVD-2026-56156

SeaweedFS is a distributed storage system. Prior to 4.24, the filer registers the SeaweedIdentityAccessManagement gRPC service without mandatory authentication when jwt.filersigning.key is unset, allowing any client that can reach the filer gRPC port to invoke CreateUser, CreateAccessKey,...

CVE-2026-72920 SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control

SeaweedFS is a distributed storage system. Prior to 4.24, the filer registers the SeaweedIdentityAccessManagement gRPC service without mandatory authentication when jwt.filersigning.key is unset, allowing any client that can reach the filer gRPC port to invoke CreateUser, CreateAccessKey,...

CVE-2026-51584

An issue in usememos v0.27.1 allows a remote attacker to achieve account takeover via the ssoCredentials branch of the SignIn handler in server/router/api/v1/authservice.go, because SSO identity is matched only on an attacker-controllable identifier without binding to the IdP's stable subject cla...

CVE-2026-12075 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-12072 vulnerabilities

Vulnerabilities for packages: open-webui...

Windows Remote Desktop Services Elevation of Privilege Vulnerability

Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally...

Microsoft SharePoint Server Elevation of Privilege Vulnerability

Missing authentication for critical function in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...

Windows Remote Desktop Services Elevation of Privilege Vulnerability

Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally...

Microsoft SharePoint Server Elevation of Privilege Vulnerability

Improper authentication in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...

Microsoft Windows Search Component Information Disclosure Vulnerability

Weak authentication in Microsoft Windows Search Component allows an authorized attacker to disclose information locally...

Windows Remote Desktop Services Elevation of Privilege Vulnerability

Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally...

Windows Remote Desktop Services Elevation of Privilege Vulnerability

Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally...

Windows License Manager Elevation of Privilege Vulnerability

Missing authentication for critical function in Windows License Manager allows an authorized attacker to elevate privileges locally...

Microsoft Digest Authentication Elevation of Privilege Vulnerability

Numeric truncation error in Microsoft Digest Authentication allows an authorized attacker to elevate privileges locally...

Microsoft Exchange Server Elevation of Privilege Vulnerability

Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network...

Remote Access Management service/API (RPC server) Elevation of Privilege Vulnerability

Missing authentication for critical function in Windows RPC API allows an authorized attacker to elevate privileges locally...

CVE-2026-72780

Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers can replay captured login request bodies containing requestOptions and response to create additional authenticated sessions for victim accounts...

CVE-2026-72775

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the PostgresTrigger node, which interpolates user-supplied identifier parameters channel, function, and trigger names into SQL statements without proper escaping. An authenticated user can inject arbitrary SQL...

CVE-2026-72768

n8n versions before 2.32.1 contain a server-side request forgery protection bypass vulnerability in the MCP Client node that allows authenticated users to bypass SSRF protections. Attackers can craft workflows that send requests to internal or blocked hosts without routing through SSRF protection...