298339 matches found
CVE-2026-47604
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user may access another process's GPU channel state due to missing authorization checks. A successful exploit of this vulnerability might lead to information disclosure...
CVE-2026-104854: Improper Privilege Management
Nx is a monorepo solution for TypeScript and polyglot codebases. From 14.6.0 until 22.7.9 and 23.1.2, Nx creates Unix domain sockets for its daemon and isolated plugin workers in shared temporary locations without owner-only directory and socket permissions. Another unprivileged local account on ...
PT-2026-104319
User Impersonation in ProcessOnes XMMP Server ejabberd = 26.04 allows an attacker to impersonate arbitrary users via unvalidated authzid parameter in SASL-PLAIN mechanism...
CVE-2026-104733: Authentication Bypass by Spoofing
User Impersonation in ProcessOnes XMMP Server ejabberd = 26.04 allows an attacker to impersonate arbitrary users via unvalidated authzid parameter in SASL-PLAIN mechanism...
ROS-20261002-73-0118
The vulnerability of the pgcrypto module in the PostgreSQL database management system is related to the unencrypted storage of user credentials. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...
PT-2026-104447
Name of the Vulnerable Software and Affected Versions UTMStack versions prior to 11.2.16 Description Authenticated attackers can read arbitrary entity data by exploiting a JPQL injection issue. The vulnerability exists in the UtmNetworkScanService.searchPropertyValues function, which constructs a...
Debian dla-4813 : iscsiuio - security update
The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4813 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4813-1 [email protected]...
RabbitMQ 4.0.x < 4.0.22 / 4.1.x < 4.1.14 / 4.2.x < 4.2.7 Atom Exhaustion via User Tags List
The version of RabbitMQ installed on the remote host is 4.0.x prior to 4.0.22, or 4.1.x prior to 4.1.14, or 4.2.x prior to 4.2.7. It is, therefore, affected by a denial of service vulnerability: - settags/2 maps rabbitdatacoercion:toatom/1 over the user's tags list, and the 20 MB management reque...
Joomla 1.5.x < 5.4.9 / 6.0.x < 6.1.4 Multiple Vulnerabilities (joomla-6-1-4-5-4-9-security-bugfix-release)
According to its self-reported version, the instance of Joomla! running on the remote web server is 1.5.x prior to 5.4.9 or 6.0.x prior to 6.1.4. It is, therefore, affected by multiple vulnerabilities. - Joomla! Core - 20260902 - Core - Unauthorized user account creation via profile.save controll...
Uniview IP Cameras Improper Authentication (CVE-2023-0773)
Some Uniview IPC products have an access control vulnerability in their web-based management interface. A remote, unauthenticated attacker can send specially crafted HTTP requests to modify device user credentials. Successful exploitation of this vulnerability could allow the attacker to gain...
The vulnerability of the endpoints /api/v1/user/starred and /api/v1/user/subscriptions of the Git repository management system Gitea, which allows a perpetrator to disclose protected information
The vulnerability of the /api/v1/user/starred and /api/v1/user/subscriptions endpoints of the Git repository management system Gitea is related to insufficient protection of sensitive data. Exploiting this vulnerability could allow a malicious actor to disclose protected information...
PT-2026-104073
Name of the Vulnerable Software and Affected Versions DevKit Pro versions prior to 3.0.0 Description An authentication bypass exists in the DevKit Pro plugin for WordPress. The issue occurs because the revert switch handler trusts the original user id cookie, which is controlled by the attacker, ...
PT-2026-104249
YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered email addresses through differing responses. Attackers can submit emails to the MotDePassePerdu recovery page without rate limiting to identify vali...
CVE-2026-79618: Missing Authorization
The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts...
ROS-20261002-73-0120
The vulnerability of the pgcrypto module in the PostgreSQL database management system is related to the unencrypted storage of user credentials. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...
ROS-20261002-73-0121
The vulnerability of the pgcrypto module in the PostgreSQL database management system is related to the unencrypted storage of user credentials. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...
CVE-2026-104439: Observable Response Discrepancy
YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered email addresses through differing responses. Attackers can submit emails to the MotDePassePerdu recovery page without rate limiting to identify vali...
PT-2026-104376
Name of the Vulnerable Software and Affected Versions Next.js versions 15.0.0 through 15.5.26 Next.js versions prior to 16.3.8 Description Applications using a root-level catch-all page and statically generated or Incremental Static Regeneration ISR routes use a shared response cache key that is...
Zammad GmbH Zammad Session Fixation Vulnerability
Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490...
Vulnerability of endpoints /api/v1/user/orgs and /api/v1/users/{username}/orgs/{org}/permissions of the Git repository management system Gitea, allowing attackers to disclose sensitive information
The vulnerability of endpoints /api/v1/user/orgs and /api/v1/users/username/orgs/org/permissions in the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...