172002 matches found
org.apache.artemis:artemis-server: org.apache.activemq:artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication
A flaw was found in Apache Artemis and Apache ActiveMQ Artemis. An unauthenticated remote attacker can exploit a missing authentication for critical function vulnerability by using the Core protocol. This allows the attacker to force a target broker to establish an outbound Core federation...
CVE-2026-73216
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, shutdownclientconnection in src/server/nsturnserver.c prematurely calls decquota and releases bandwidth accounting during the first-stage close of a mobility-enabled allocation while preserving the allocation,...
CVE-2026-73215
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, turnportsallocateeven in src/apps/relay/turnports.c marks the unused odd sibling port as TPSTAKENODD for an EVEN-PORT Allocate request with reservation bit R=0 even though no RTCP socket will release it, allowin...
CVE-2026-73214
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, dtlsserverinputhandler and createnewconnectedudpsocket in src/apps/relay/dtlslistener.c retain OpenSSL dtls1reassemblefragment state for a 35-byte fragmented ClientHello declaring a 650,000-byte handshake before...
CVE-2026-73212
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.1, goodpeeraddr in src/server/nsturnserver.c uses ioaaddrinrange in src/client/nsturnioaddr.c without canonicalizing IPv4-compatible, 6to4, and 64:ff9b::/96 NAT64 address forms, allowing an authenticated RFC 6062 T...
CVE-2026-73085
Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.36.0, the jwtAuthCheck function in server/auth/TokenManager.js treats JWTs with the refresh token type as bearer access tokens on API and WebSocket resource endpoints such as /api/me instead of restricting them to...
CVE-2026-64921
Missing authentication for critical function in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...
CVE-2026-62911
Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network...
CVE-2026-62869
Insufficient verification of data authenticity in Azure Entra ID allows an authorized attacker to perform spoofing over a network...
CVE-2026-62827
Improper authentication in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...
CVE-2026-62777
Missing authentication for critical function in Windows License Manager allows an authorized attacker to elevate privileges locally...
CVE-2026-62757
Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to bypass a security feature over a network...
CVE-2026-62698
Numeric truncation error in Microsoft Digest Authentication allows an authorized attacker to elevate privileges locally...
CVE-2026-61367
Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally...
CVE-2026-61365
Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally...
CVE-2026-61364
Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally...
CVE-2026-61356
Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally...
CVE-2026-59135
Weak authentication in Microsoft Windows Search Component allows an authorized attacker to disclose information locally...