Lucene search
+L

169125 matches found

CVE
CVE
added 2026/08/11 4:40 p.m.35 views

CVE-2026-73085

CVE-2026-73085 affects Audiobookshelf prior to version 2.36.0. The issue arises in jwtAuthCheck (server/auth/TokenManager.js): JWTs with the refresh token type are treated as bearer access tokens on API and WebSocket endpoints (e.g., /api/me) instead of being restricted to /auth/refresh, enabling...

5.3CVSS5.3AI score0.00267EPSS
SaveExploits0References5
OSV
OSV
added 2026/08/11 4:40 p.m.14 views

CVE-2026-73085 Audiobookshelf: Refresh Token Accepted on Resource Endpoints

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.36.0, the jwtAuthCheck function in server/auth/TokenManager.js treats JWTs with the refresh token type as bearer access tokens on API and WebSocket resource endpoints such as /api/me instead of restricting them to...

5.3CVSS5.4AI score
SaveExploits0References7
EUVD
EUVD
added 2026/08/11 4:40 p.m.6 views

EUVD-2026-56553

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.36.0, the jwtAuthCheck function in server/auth/TokenManager.js treats JWTs with the refresh token type as bearer access tokens on API and WebSocket resource endpoints such as /api/me instead of restricting them to...

5.3CVSS5.3AI score0.00267EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/08/11 4:40 p.m.33 views

CVE-2026-73085 Audiobookshelf: Refresh Token Accepted on Resource Endpoints

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.36.0, the jwtAuthCheck function in server/auth/TokenManager.js treats JWTs with the refresh token type as bearer access tokens on API and WebSocket resource endpoints such as /api/me instead of restricting them to...

5.3CVSS0.00267EPSS
SaveExploits0References5
Circl
Circl
added 2026/08/11 4:40 p.m.8 views

CVE-2025-31114

creationtimestamp| type| source ---|---|--- 2026-08-11 16:40:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mst2jrpkgr2u 2026-08-14 04:50:03+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mszeav5rli2f...

9.3CVSS4.8AI score0.00875EPSS
SaveExploits0References2
RedHat Linux
RedHat Linux
added 2026/08/11 4:39 p.m.7 views

org.apache.artemis:artemis-server: org.apache.activemq:artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication

A flaw was found in Apache Artemis and Apache ActiveMQ Artemis. An unauthenticated remote attacker can exploit a missing authentication for critical function vulnerability by using the Core protocol. This allows the attacker to force a target broker to establish an outbound Core federation...

9.8CVSS8.3AI score0.10049EPSS
SaveExploits1References5
RedHat Linux
RedHat Linux
added 2026/08/11 4:39 p.m.17 views

picketlink-federation: auth bypass in Picketlink SAML unsolicited-response

A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted...

9.8CVSS5.3AI score0.00303EPSS
SaveExploits0References4
RedHat Linux
RedHat Linux
added 2026/08/11 4:39 p.m.6 views

wildfly-iiop-openjdk: Missing authentication on EAP's IIOP NameService leads to MITM or DoS

A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations...

7.4CVSS5.3AI score0.0029EPSS
SaveExploits0References4
RedHat Linux
RedHat Linux
added 2026/08/11 4:39 p.m.5 views

picketlink-federation: picketlink SAML 2.0 auth bypass via missing assertions

A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application...

8.1CVSS5.4AI score0.00218EPSS
SaveExploits0References4
RedHat Linux
RedHat Linux
added 2026/08/11 4:39 p.m.9 views

undertow-core: Undertow: Authentication Bypass via AJP ssl_cert/is_ssl Forgery

the Undertow AJP listener honours forged sslcert and isssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP...

7.4CVSS5.4AI score0.00222EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/08/11 4:27 p.m.33 views

CVE-2026-20891

Improper authentication for some IntelR PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable local code execution. This result may...

6.3CVSS0.00158EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/11 4:27 p.m.6 views

EUVD-2026-56508

Improper authentication for some IntelR PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable local code execution. This result may...

6.3CVSS5.3AI score0.00158EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/11 4:27 p.m.20 views

CVE-2026-20891

The CVE concerns Intel(R) PROSet/Wireless WiFi Software for Windows, Ring 2: Device Drivers. It states improper authentication may allow local privilege escalation by an unauthenticated, low-complexity attacker with local access, enabling local code execution. The impact per the description inclu...

6.3CVSS5.3AI score0.00158EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/11 4:26 p.m.30 views

CVE-2026-20885

Improper authentication in the IntelR TDX module for some IntelR platforms within Ring 0: Trust Domain may allow an information disclosure and escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This...

7CVSS0.00148EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/11 4:26 p.m.45 views

CVE-2026-20885

CVE-2026-20885 concerns the Intel(R) TDX module on certain Intel platforms, where improper authentication in the Ring 0 Trust Domain can enable information disclosure and privilege escalation. The NVD/CVE records describe a local-attack scenario requiring a privileged user, with high attack compl...

7CVSS5.1AI score0.00148EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/11 4:26 p.m.6 views

EUVD-2026-56505

Improper authentication in the IntelR TDX module for some IntelR platforms within Ring 0: Trust Domain may allow an information disclosure and escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This...

7CVSS5.1AI score0.00148EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/11 4:25 p.m.24 views

CVE-2026-20752

Improper authentication for some IntelR PROSet/Wireless WiFi Software within Ring 0: Kernel may allow an information disclosure. System software adversary with a privileged user combined with a low complexity attack may enable data exposure. This result may potentially occur via local access when...

6.7CVSS0.00143EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/11 4:25 p.m.25 views

CVE-2026-20752

Technical details about CVE-2026-20752 are not publicly provided in the supplied documents; no affected products, versions, or fixes are disclosed. Monitor for updates from NVD/CVE sources.

6.7CVSS5.2AI score0.00143EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/11 4:25 p.m.7 views

EUVD-2026-56487

Improper authentication for some IntelR PROSet/Wireless WiFi Software within Ring 0: Kernel may allow an information disclosure. System software adversary with a privileged user combined with a low complexity attack may enable data exposure. This result may potentially occur via local access when...

6.7CVSS5.2AI score0.00143EPSS
SaveExploits0References1
Debian CVE
Debian CVE
added 2026/08/11 4:25 p.m.9 views

CVE-2026-20713

Always-incorrect control flow implementation in some firmware for some IntelR XeonR processors may allow an escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via...

4.5CVSS5.2AI score0.00102EPSS
SaveExploits0
Rows per page
Query Builder