Zoho ManageEngine OpManger - Arbitrary File Read

Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a specially crafted request. id: CVE-2020-12116 info: name: Zoho ManageEngine OpManger - Arbitrary File Read author:...

CVE-H3C-Report

H3C GR-Serie Router Systemverwaltung weist Schwachstelle für unbefugten Zugriff auf Produkt : GR-Serie Router Version : alle Bewertung : hohes Risiko Webseite : http://www.h3c.com/ Gefahren : Angreifer können diese Schwachstelle ausnutzen, um sensible Informationen von Routern zu erlangen, indem...

EUVD-2026-66118

In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust-scoped authentication could create new long-lived credentials or authorize new delegations that persist independently of, and outlive, the credential used to obtain them. The delegation...

PT-2026-82338

Name of the Vulnerable Software and Affected Versions disconf version 2.6.36 Description Incorrect Access Control allows anonymous attackers to read all configuration items and files managed by the config center. This occurs because the LoginInterceptor explicitly whitelists specific...

CVE-2026-75338

disconf (Distributed Configuration Management Platform) version 2.6.36 suffers from an Incorrect Access Control flaw. The LoginInterceptor explicitly whitelists four config-fetching endpoints—/api/config/item, /api/config/file, /api/config/list, and /api/config/simple/list—bypassing authenticatio...

EUVD-2025-210791

A Broken Access Control vulnerability exists in ThingsBoard Professional Edition PE 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows...

CVE-2026-75338

disconf Distributed Configuration Management Platform 2.6.36 is vulnerable to Incorrect Access Control. The config-fetching APIs /api/config/item, /api/config/file, /api/config/list and /api/config/simple/list are exposed without authentication. The LoginInterceptor explicitly whitelists these fo...

EUVD-2025-210787

Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/internal/v1/users/USERID endpoint...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098840)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098840 advisory. In the Linux kernel, the following vulnerability has been resolved: apparmor: fix missing bounds check on DEFAULT table in verifydfa The verifydfa function only chec...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098668)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098668 advisory. Uncontrolled resource consumption in the Linux kernel drivers for IntelR SGX may allow an authenticated user to potentially enable denial of service via local access...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: struts (UTSA-2026-031330)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-031330 advisory. The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098894)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098894 advisory. In the Linux kernel, the following vulnerability has been resolved: gcov: use atomic counter updates to fix concurrent access crashes GCC's GCOV instrumentation can...

EUVD-2026-66748

AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java retrieves the userid from the request header as the core of the identity verification mechanism, allowing attackers to forge any user identity credential information, thereby causing sensitive...

The vulnerability of the keycloak-services component of the Keycloak identity and access management software allows a perpetrator to bypass existing security mechanisms and gain unauthorized access to the system.

The vulnerability of the keycloak-services component of the Keycloak identity and access management software is related to the lack of a password recovery mechanism. Exploiting this vulnerability could allow an attacker to bypass existing security measures and gain unauthorized access to the syst...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098810)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098810 advisory. In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Limit PTP to a single page Commit 391e69143d0a increased CTPTPNUM from 1 to 4 to...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098881)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098881 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: marvell/cesa - Handle zero-length skcipher requests Do not access random memory for...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: struts (UTSA-2026-031329)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-031329 advisory. ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrar...

Linux Distros Unpatched Vulnerability : CVE-2026-78959

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper handling of case sensitivity in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass...

Linux Distros Unpatched Vulnerability : CVE-2026-79089

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Race condition in Transactions Platform in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass...

PT-2026-82223

Name of the Vulnerable Software and Affected Versions Midday affected versions not specified Description An authorization flaw exists in the team management logic where the system fails to verify the user role during team deletion and updates. The delete procedure in the...