76570 matches found
CVE-2026-108157 Pingvin Share X 0.19.0 before 1.22.0 Account Takeover via OAuth Email Linking
Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to take over accounts by abusing automatic OAuth email linking in OAuthService.signUp. Attackers can register a victim's unverified email on an enabled OAuth/OI...
windows-security-cve-2017-8543
Example InSpec Profile This example shows the implementation of an InSpec profile...
CVE-2022-21668-Pipenv-RCE-vulnerability
CVE-2022-21668-Pipenv-RCE-vulnerability 1. Introduction In this document the Pipenv vulnerabilityCVE-2022-21668 is discussed in detail. The following sections cover the bug code in pipenv/utils.py file which opens up the door for various RCE attacks and also about the recent fix which validates...
CVE-2026-15340
lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow...
CVE-2026-29797 Red Lion Controls N-Tron 700 Series Download of Code Without Integrity Check
No authentication is required when updating firmware or bootloader, making it easy for malicious files to be pushed to the device. Additionally, anyone with the same software can scan a network for N-Tron devices and push/pull firmware without authenticating by using SNMP/TFTP...
Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy
Summary PermissionExtension.resolve evaluates the return value of haspermission for truthiness on the synchronous path. supportssync only classifies a permission as asynchronous when haspermission is declared with async def via inspect.iscoroutinefunction, so a plain def that returns an awaitable...
Check Risk WAF
Check Risk WAF Российское комплексное облачное WAF-решение для защиты веб-приложений и инфраструктуры Russian integrated cloud WAF solution for web application and infrastructure protection Сайт · Документация · Русский · English Русская версия Check Risk WAF – это Российское комплексное облачное...
CVE-2023-33668
CVE-2023-33668 Summary DigiExam is a surveillance exam and proctoring software. The software is installed in schools' or students' computers. When the student joins an exam, DigiExam will: ensure it's not running in a Virtual Machine, terminate all applications, fullscreen itself, and prevent the...
EUVD-2026-95694
The maxage authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity. Any relying party using setMaxAgeOffset to enforce re-authentication would silently accept sessions of any age, bypassing step-...
CVE-2026-71575 Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter
The maxage authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity. Any relying party using setMaxAgeOffset to enforce re-authentication would silently accept sessions of any age, bypassing step-...
CVE-2026-78017
Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 are susceptible to an Improper Check for Unusual or Exceptional Conditions vulnerability (CWE-754). A high privileged attacker with remote access could exploit this flaw to achieve Information tampering and a Protection...
CVE-2026-106095
The Code Snippets WordPress plugin before 3.10.0 does not perform a capability check on one of its snippet-management actions and derives the network scope of the targeted snippet from the request instead of from the stored record, allowing an administrator of a single subsite on a multisite...
CVE-2026-0092
CVE-2026-0092 Dans Package Manager, un contournement du contrôleur de verrouillage de l'appareil est possible en raison d'un contrôle des autorisations manquant. Cela pourrait entraîner une élévation locale de privilèges sans nécessiter de privilèges d'exécution supplémentaires. Aucune interactio...
CVE-2026-11111-TOCTOU-in-File-Permission-Check-Before-Open
CVE-2026-11111 – TOCTOU dans la vérification des permissions de fichier avant ouverture Code du programme Python toctouserver.py - File server that checks permission then opens import os, time, tempfile from flask import Flask, request app = Flaskname SAFEDIR = '/tmp/safe' @app.route'/read' def...
CVE-2026-106095
The Code Snippets WordPress plugin in versions before 3.10.0 is vulnerable to a privilege escalation issue due to a missing capability check on a snippet-management action. The application incorrectly derives the network scope of a targeted snippet from the request rather than the stored record. ...
EUVD-2026-95506
The Code Snippets WordPress plugin before 3.10.0 does not perform a capability check on one of its snippet-management actions and derives the network scope of the targeted snippet from the request instead of from the stored record, allowing an administrator of a single subsite on a multisite...
CVE-2026-106095 Code Snippets < 3.10.0 - Admin+ Network-Scoped Snippet Activation and Deactivation via update_code_snippet
The Code Snippets WordPress plugin before 3.10.0 does not perform a capability check on one of its snippet-management actions and derives the network scope of the targeted snippet from the request instead of from the stored record, allowing an administrator of a single subsite on a multisite...
CVE-2024-12252
CVE-2024-12252 SEO LAT Auto Post = 2.2.1 - Autorisation manquante pour l'écrasement/téléversement de fichier Exécution de code à distance Description Le plugin SEO LAT Auto Post pour WordPress est vulnérable à l'écrasement de fichiers en raison d'un contrôle de capacité manquant sur l'action AJAX...
CVE-2026-69098_exploit
CVE-2026-69098 — kotaemon : RCE par désérialisation non authentifiée Exécution de code à distance non authentifiée dans kotaemon = 0.12.0 via une désérialisation non sécurisée dans la vérification de connexion des paramètres LLM. Le bug Le gestionnaire Gradio checkconnection des paramètres LLM de...