375256 matches found
EUVD-2026-94760
The GPTranslate WordPress plugin before 2.34.14 does not properly restrict who can store translations, and does not escape them when outputting them in translated pages, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks when server-side translations are enabled...
CVE-2026-94586
A command injection vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with permissions to perform configuration downloads using...
CVE-2026-87686
An authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabric OS versions before 10.0.1. The web dispatcher routine evaluates internal management VLAN trust decisions using the client-supplied HTTP host header instead of the actual socke...
CVE-2026-87659
A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1. A compromised switch connected to the fabric can transmit crafted inband Fibre Channel vendor-unique CT Common Transport management requests to bypass administrative...
CVE-2026-87678
An input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versions before 10.0.1. When configuring Federated Authentication FA, the system fails to sanitize the Identity Provider IdP issuer parameter. An authenticated administrator—or an...
CVE-2026-87686
An authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabric OS versions before 10.0.1. The web dispatcher routine evaluates internal management VLAN trust decisions using the client-supplied HTTP host header instead of the actual socke...
CVE-2026-87686
An authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabric OS versions before 10.0.1 . The vulnerability is caused by the web dispatcher routine evaluating internal management VLAN trust decisions based on the client-supplied HTTP hos...
EUVD-2026-94670
An authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabric OS versions before 10.0.1. The web dispatcher routine evaluates internal management VLAN trust decisions using the client-supplied HTTP host header instead of the actual socke...
EUVD-2026-94668
A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1. A compromised switch connected to the fabric can transmit crafted inband Fibre Channel vendor-unique CT Common Transport management requests to bypass administrative...
CVE-2026-87659
A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1. A compromised switch connected to the fabric can transmit crafted inband Fibre Channel vendor-unique CT Common Transport management requests to bypass administrative...
CVE-2026-87659
A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1 . A compromised switch within the fabric can send crafted inband Fibre Channel vendor-unique CT (Common Transport) management requests to circumvent administrative au...
CVE-2026-87659
A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1. A compromised switch connected to the fabric can transmit crafted inband Fibre Channel vendor-unique CT Common Transport management requests to bypass administrative...
CVE-2026-58264
A flaw was found in FluidSynth. The pitchbendrange command handler does not check that the channel argument is inside the synthesizer channel array before writing the supplied value, which is an out-of-bounds heap write. An attacker who can send commands to the FluidSynth shell can crash the...
CVE-2026-102488
In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obtain deployment permissions beyond those actually granted to them...
CVE-2026-102488
Octopus Server is vulnerable to an incorrect authorization issue (CWE-863) caused by the software incorrectly evaluating multiple scoped permission assignments. This flaw allows a highly privileged user to obtain deployment permissions that exceed their actual granted authority. No specific affec...
EUVD-2026-94659
In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obtain deployment permissions beyond those actually granted to them...
CVE-2026-102488
In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obtain deployment permissions beyond those actually granted to them...
CVE-2024-8122
The WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords OTPs used in multi-factor authentication MFA. This allows unused OTPs to remain valid indefinitely, presenting an opportunity for malicious actors to conduct brute force attacks by repeatedly guessing the...
CLEANSTART-2026-MW74031 Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network
Security vulnerability affects the apache-hive package. Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network...