349757 matches found
VMware vCenter Server LDAP Broken Access Control
Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller PSC, does not correctly implement access controls. id: CVE-2020-3952 info: name: VMware vCenter Server LDAP Broken Access Control author: 0xAkoko severity: critic...
Zyxel NAS Firmware 5.21- Remote Code Execution
Multiple Zyxel network-attached storage NAS devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device. Zyxel NAS devices achieve authentication by using th...
XStream <1.4.15 - Server-Side Request Forgery
XStream before 1.4.15 is susceptible to server-side request forgery. An attacker can request data from internal resources that are not publicly available by manipulating the processed input stream, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorize...
mac0352-ep4
mac0352-ep4 Apache HTTP Server 2.4.23 vulnerability study CVE-2016-8740...
CVE-2026-102488
In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obtain deployment permissions beyond those actually granted to them...
CVE-2026-102488
Octopus Server is vulnerable to an incorrect authorization issue (CWE-863) caused by the software incorrectly evaluating multiple scoped permission assignments. This flaw allows a highly privileged user to obtain deployment permissions that exceed their actual granted authority. No specific affec...
EUVD-2026-94659
In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obtain deployment permissions beyond those actually granted to them...
CVE-2024-8122
The WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords OTPs used in multi-factor authentication MFA. This allows unused OTPs to remain valid indefinitely, presenting an opportunity for malicious actors to conduct brute force attacks by repeatedly guessing the...
CLEANSTART-2026-MW74031 Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network
Security vulnerability affects the apache-hive package. Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network...
CLEANSTART-2026-FP59456 In Eclipse Jetty Server, all 9
Security vulnerability affects the apache-hive package. In Eclipse Jetty Server, all 9...
CLEANSTART-2026-WA43103 In Eclipse Jetty Server, versions 9
Security vulnerability affects the apache-hive package. In Eclipse Jetty Server, versions 9...
CVE-2024-6386-WPML-SSTI
This repository does not have a README...
CLEANSTART-2026-ZX09100 Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding
Security vulnerability affects the apache-nifi-registry package. Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding...
CLEANSTART-2026-MH81901 Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments
Security vulnerability affects the apache-nifi-registry package. Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events SSE with view fragments...
CLEANSTART-2026-SB20243 Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE)
Security vulnerability affects the apache-nifi-registry package. Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE...
CLEANSTART-2026-JY60048 In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled
Security vulnerability affects the elasticsearch package. In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled...
CLEANSTART-2026-AF62012 incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs
CVE-2026-46597 affects multiple packages. An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs. See references for individual vulnerability details...
CLEANSTART-2026-HL09755 OpenTelemetry-Go is the Go implementation of OpenTelemetry
Security vulnerability affects the temporal-server-fips package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...
CLEANSTART-2026-JP32087 When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as fo...
CVE-2026-39828 affects multiple packages. When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. See reference...