CVE-2026-19080

Menulux Portal by Menulux Software Inc. is affected by an observable response discrepancy that enables account footprinting (username enumeration). An unauthenticated remote attacker can identify valid accounts by observing differing responses, leading to high confidentiality impact (CVSS 3.1: 7....

CVE-2026-19080 Username Enumeration in Menulux Software's Menulux Portal

Observable response discrepancy vulnerability in Menulux Software Inc. Menulux Portal allows Account Footprinting. This issue affects Menulux Portal: before 20260903211448...

CVE-2026-19080 Username Enumeration in Menulux Software's Menulux Portal

Observable response discrepancy vulnerability in Menulux Software Inc. Menulux Portal allows Account Footprinting. This issue affects Menulux Portal: before 20260903211448...

EUVD-2026-71040

Observable response discrepancy vulnerability in Menulux Software Inc. Menulux Portal allows Account Footprinting. This issue affects Menulux Portal: before 20260903211448...

Authorization Bypass Through User-Controlled Key

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the bulk delete process. An attacker can gain unauthorized access to and modify or disable accounts outside their permitt...

CVE-2026-85591 phpMyFAQ before 4.1.8 Authentication Bypass via Unverified Password Change

phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user control panel API endpoint that allows authenticated attackers to change account passwords without verifying the current password. Attackers with session access can submit a PUT request to the user data upda...

CVE-2026-85591 phpMyFAQ before 4.1.8 Authentication Bypass via Unverified Password Change

phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user control panel API endpoint that allows authenticated attackers to change account passwords without verifying the current password. Attackers with session access can submit a PUT request to the user data upda...

CVE-2026-85591 phpMyFAQ before 4.1.8 Authentication Bypass via Unverified Password Change

phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user control panel API endpoint that allows authenticated attackers to change account passwords without verifying the current password. Attackers with session access can submit a PUT request to the user data upda...

CVE-2026-85591

phpMyFAQ versions before 4.1.8 contain an authentication bypass in the user control panel API endpoint . The root cause is that the password-change handler does not verify the current password before accepting a new one. An attacker with an existing valid session can submit a PUT request to the u...

EUVD-2026-71014

phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user control panel API endpoint that allows authenticated attackers to change account passwords without verifying the current password. Attackers with session access can submit a PUT request to the user data upda...

CVE-2026-4644

A Missing Authorization vulnerability in HTTP Connector in Google Cloud Integration Connectors versions prior to 2025-12-11 on Google Cloud Platform allows an authenticated user to escalate privileges and take over a Google Cloud Project using unauthorized service account attachment. This...

EUVD-2026-70996

A Missing Authorization vulnerability in HTTP Connector in Google Cloud Integration Connectors versions prior to 2025-12-11 on Google Cloud Platform allows an authenticated user to escalate privileges and take over a Google Cloud Project using unauthorized service account attachment. This...

CVE-2026-4644 Improper Authorization in Google Cloud Integration Connectors Leads to Project Takeover

A Missing Authorization vulnerability in HTTP Connector in Google Cloud Integration Connectors versions prior to 2025-12-11 on Google Cloud Platform allows an authenticated user to escalate privileges and take over a Google Cloud Project using unauthorized service account attachment. This...

CVE-2026-4644

A Missing Authorization vulnerability in the HTTP Connector of Google Cloud Integration Connectors (versions prior to 2025-12-11) allowed an authenticated user to escalate privileges and take over a Google Cloud Project via unauthorized service account attachment. The flaw enabled a user with low...

CVE-2026-4644 Improper Authorization in Google Cloud Integration Connectors Leads to Project Takeover

A Missing Authorization vulnerability in HTTP Connector in Google Cloud Integration Connectors versions prior to 2025-12-11 on Google Cloud Platform allows an authenticated user to escalate privileges and take over a Google Cloud Project using unauthorized service account attachment. This...

Exploit for CVE-2024-36058

CVE-2024-36058 — Koha Library Software CVE ID: CVE-2024-3...

CVE-2026-85528

Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver versions 4.2.0 through 4.3.3 allowed a credential-bearing login request to be redirected to an attacker-selected HTTPS endpoint. An attacker able to control the account value could cause the driver to...

EUVD-2026-70974

Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver versions 4.2.0 through 4.3.3 allowed a credential-bearing login request to be redirected to an attacker-selected HTTPS endpoint. An attacker able to control the account value could cause the driver to...

CVE-2026-85528 Snowflake JDBC Driver auto-configuration account validation permits credential redirection

Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver versions 4.2.0 through 4.3.3 allowed a credential-bearing login request to be redirected to an attacker-selected HTTPS endpoint. An attacker able to control the account value could cause the driver to...

CVE-2026-85528 Snowflake JDBC Driver auto-configuration account validation permits credential redirection

Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver versions 4.2.0 through 4.3.3 allowed a credential-bearing login request to be redirected to an attacker-selected HTTPS endpoint. An attacker able to control the account value could cause the driver to...