615763 matches found
Insecure Randomness
Overview Affected versions of this package are vulnerable to Insecure Randomness through the JWT signing flow in DefaultSecretProvider and JwtServiceImpl under powerjob-server-auth. An attacker can forge HS256-signed JWTs by using the predictable signing key and then send those tokens to the serv...
CVE-2026-80117
PassMark PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016) contain a privilege escalation vulnerability in the DirectIo64.sys kernel driver. The root cause is missing allowlist or port validation on exposed IOCTLs , allowing a ...
CVE-2026-80117 PassMark PerformanceTest, BurnInTest, and OSForensics Arbitrary I/O Port Access via DirectIo64.sys
PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation vulnerability in DirectIo64.sys that allows local users to issue arbitrary IN and OUT instructions to any x86 I/O port due to missing allowlist...
CVE-2026-80112 PassMark PerformanceTest, BurnInTest, and OSForensics Improper Access Control via DirectIo64.sys
PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an improper access control vulnerability in the DirectIo64.sys kernel driver that allows unprivileged local users to perform privileged hardware operations by opening...
CVE-2026-80112
PassMark PerformanceTest , BurnInTest , and OSForensics each ship a vulnerable DirectIo64.sys kernel driver. The root cause is an improper access control flaw: the device object is created without a security descriptor, so Windows applies a permissive default ACL . This allows unprivileged local ...
EUVD-2026-71683
PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an improper access control vulnerability in the DirectIo64.sys kernel driver that allows unprivileged local users to perform privileged hardware operations by opening...
CVE-2026-61608
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, UserInvitation entities have no expiry timestamp. Invitation links mailed to users remain valid indefinitely, meaning a leaked, forwarded, or archived invitation email can be used at any time in the future to join a compan...
CVE-2026-9317 Nango < 0.71.6 Missing Authentication RCE via runner tRPC server
Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests ...
EUVD-2026-71631
Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests ...
MGASA-2026-0376 Updated tomcat packages fix security vulnerabilities
Incorrect URL decoding in RewriteValve may allow security control bypass. CVE-2026-59083 EncryptInterceptor requirements not clearly documented. CVE-2026-59084 DoS via WebSocket chat example. CVE-2026-66299 Bypass longest prefix security constraint. CVE-2026-65182 TOCTOU when setting specific...
CVE-2026-61688 SolidInvoice allows cross-user access to API token request history via writable DataGrid LiveComponent props
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, an authenticated user can view the API request history of any other user's API tokens within the same company by manipulating two writable Symfony UX LiveComponent props on the DataGrid component. Version 3.0.1 fixes the...
CVE-2026-61688
SolidInvoice , an open-source invoicing platform, is affected by a cross-user information disclosure vulnerability prior to version 3.0.1 . An authenticated user can view the API request history of any other user's API tokens within the same company by manipulating two writable Symfony UX LiveCom...
CVE-2026-61688 SolidInvoice allows cross-user access to API token request history via writable DataGrid LiveComponent props
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, an authenticated user can view the API request history of any other user's API tokens within the same company by manipulating two writable Symfony UX LiveComponent props on the DataGrid component. Version 3.0.1 fixes the...
EUVD-2026-71622
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, UserInvitation entities have no expiry timestamp. Invitation links mailed to users remain valid indefinitely, meaning a leaked, forwarded, or archived invitation email can be used at any time in the future to join a compan...
CVE-2026-61608
SolidInvoice , an open-source invoicing platform, is affected by a flaw in its UserInvitation entities prior to version 3.0.1 . The root cause is the absence of an expiry timestamp on invitation tokens, causing mailed invitation links to remain valid indefinitely. An attacker who obtains a leaked...
CVE-2026-61608 SolidInvoice's user invitation tokens have no expiry, allowing indefinite unauthorized company access via leaked or old invitation links
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, UserInvitation entities have no expiry timestamp. Invitation links mailed to users remain valid indefinitely, meaning a leaked, forwarded, or archived invitation email can be used at any time in the future to join a compan...
CVE-2026-61608 SolidInvoice's user invitation tokens have no expiry, allowing indefinite unauthorized company access via leaked or old invitation links
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, UserInvitation entities have no expiry timestamp. Invitation links mailed to users remain valid indefinitely, meaning a leaked, forwarded, or archived invitation email can be used at any time in the future to join a compan...
CVE-2026-61686 SolidInvoice: PHP unserialize() called on client-controlled data in DataGrid LiveComponent context prop
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the DataGrid LiveComponent deserializes a context prop value using PHP's unserialize after receiving it from the client. Because the prop is marked writable: true, an authenticated attacker can supply an arbitrary PHP...
CVE-2026-61686 SolidInvoice: PHP unserialize() called on client-controlled data in DataGrid LiveComponent context prop
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the DataGrid LiveComponent deserializes a context prop value using PHP's unserialize after receiving it from the client. Because the prop is marked writable: true, an authenticated attacker can supply an arbitrary PHP...