91027 matches found
CVE-2026-104051: Insufficiently Protected Credentials
PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the secret deletecode and uploader metadata by calling the API::info endpoint which returns the complete raw metadata object without a field whitelist. Attackers can use the...
CVE-2026-103534: Improper Access Control
A vulnerability was determined in David-Crty databasement up to 1.7.1. Affected is the function SnapshotPolicy.viewAny/SnapshotPolicy.view of the file /api/v1/snapshots of the component Snapshot Model. This manipulation causes improper access controls. Remote exploitation of the attack is possibl...
PT-2026-103693
Name of the Vulnerable Software and Affected Versions Featured Image from URL FIFU WordPress plugin versions prior to 6.0.8 Featured Image from URL FIFU Premium WordPress plugin versions prior to 8.2.8 Description Cross-Site Request Forgery CSRF occurs because the software fails to correctly...
PT-2026-103874
Unauthenticated Insecure Direct Object References IDOR in REST API Log = 1.7.2 versions...
Rocky Linux 9 [CIQ] Security Update: rhel-net-naming-sysattrs / systemd / systemd-boot-unsigned / etc (crlsa-2026_19213)
The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202619213 advisory. systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data CVE-2026-29111 Tenable has extracted the preceding description block...
CVE-2026-101147: Cross-Site Request Forgery (CSRF)
The Featured Image from URL FIFU WordPress plugin before 6.0.8, Featured Image from URL FIFU Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in...
PT-2026-105543
Summary /api/block/getRefIDs filters its results for reader roles through a helper that checks only the visibility tiers. The password tier is not checked, because the helper does not receive the request context and therefore cannot evaluate the publish auth cookie. A reader who has not entered a...
PT-2026-103803
Name of the Vulnerable Software and Affected Versions Ghost versions 4.0.0 through 6.62.0 Description A flaw in the content API allows unauthenticated visitors to access gated post content. Attackers can bypass content restrictions by directly querying the content API to retrieve restricted posts...
CVE-2026-103275: Observable Discrepancy
Ghost 5.42.2 before 6.58.0 contains an information disclosure vulnerability in the Admin API bulk post and page edit and delete endpoints, which accept filters on restricted fields such as authors.password, because of an incomplete fix for CVE-2026-70590. Staff-level attackers can infer other sta...
PT-2026-103901
HCL BigFix Service Management is affected by an Information Disclosure vulnerability because two exposed API endpoints return sensitive data. This information could enable an attacker to launch further, more serious attacks...
CentOS Linux 6 [TuxCare] Security Update: libsmbclient / libsmbclient-devel / samba / samba-client / etc Multiple Vulnerabilities (CENTOS6:CLSA-2026:1779902912)
The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1779902912 advisory. - A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply ...
Rocky Linux 8 [CIQ] Security Update: bpftool / bpftool-debuginfo / kernel / kernel-abi-stablelists / etc Multiple Vulnerabilities (crlsa-2021_2168)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20212168 advisory. kernel: userspace applications can misuse the KVM API to cause a write of 16 bytes at an offset up to 32 GB from vcpu-run CVE-2021-3501 kernel: nitroenclav...
Rocky Linux 8 [CIQ] Security Update: resource-agents / resource-agents-aliyun / etc Multiple Vulnerabilities (crlsa-2026_1241)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20261241 advisory. urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion CVE-2025-66418 urllib3: urllib3 Streaming API improperly handles highly...
Rocky Linux 8 [CIQ] Security Update: fence-agents-aliyun / fence-agents-aliyun-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_1240)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20261240 advisory. urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion CVE-2025-66418 urllib3: urllib3 Streaming API improperly handles highly...
Rocky Linux 10.1 [CIQ] Security Update: python3-urllib3 Multiple Vulnerabilities (crlsa-2026_1086)
The Rocky Linux 10.1 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-20261086 advisory. urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion CVE-2025-66418 urllib3: urllib3 Streaming API improperly handles highly...
AlmaLinux 9.6 [TuxCare] Security Update: rhel-net-naming-sysattrs / systemd / systemd-boot-unsigned / etc (ALMALINUX9.6:CLSA-2026:1779217317)
The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779217317 advisory. - systemd, a system and service manager, as PID 1 hits an assert and freezes execution when an unprivileged IPC API call is made with spuriou...
Rocky Linux 9 [CIQ] Security Update: python3.11-urllib3 Multiple Vulnerabilities (crlsa-2026_1089)
The Rocky Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-20261089 advisory. urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion CVE-2025-66418 urllib3: urllib3 Streaming API improperly handles highly...
PT-2026-105174
RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.22 and 4.1.14 and 4.2.7, Admin-only atom exhaustion: PUT /api/users tags list. settags/2 maps rabbitdatacoercion:toatom/1 over the user's tags list. The 20 MB management body limit fits 3-4M short tag strings. An administrator can...
PT-2026-105126
Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1, the device token deduplication logic for installation records does not validate the type of client-supplied installation fields before using them to build database queries. An...
PT-2026-103969
šØ CVE-2026-104059 Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, ...