30941 matches found
CVE-2026-14951: Cross-Site Request Forgery (CSRF)
An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web pages...
EUVD-2026-62446
phpMyFAQ before 4.1.7 contains a SQL injection vulnerability in the glossary create and update endpoints caused by truncating an escaped string before embedding it in a SQL literal. Authenticated users with glossary add or edit permissions can craft a payload with a dangling backslash to escape t...
GHSA-7CJ5-V4PP-V632 LibreNMS: Stored XSS via graph_descr admin config settings echoed without escaping to all authenticated users
Summary The graphdescr. family of settings is echoed verbatim without htmlspecialchars in includes/html/pages/graphs.inc.php:194. Any admin can store a malicious HTML payload that executes in every authenticated user's browser viewing that graph type. CVSS...
CVE-2026-23937
The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity...
SUSE CVE-2026-63650
OpenVPN 2.7alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field...
CVE-2026-75842: Improper Limitation of a Pathname to a Restricted Directory
ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read local files. Attackers with read query privileges can use the file:// protocol in LOAD CSV statements to access arbitrary files with server...
CVE-2026-23937: Observable Discrepancy
The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity...
BIT-AIRFLOW-2026-54183 Apache Airflow: Airflow Variables were not masked in the UI for authenticated users
Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was show...
Security Bulletin: Code Injection Vulnerability in Code Validation Endpoint
Summary A code injection vulnerability was identified in the code validation endpoint that allowed authenticated users to execute arbitrary code on the server. The vulnerability existed in the validation logic which compiled and executed function definitions to check for import errors. Attackers...
EUVD-2026-58542
streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users' viewing status records. Attackers can enumerate all users' watch progress, delete arbitrary viewing history, and manipulate other users'...
CVE-2026-63649: Permissive List of Allowed Inputs
The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7alpha1 through 2.7.5 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via crafted options that bypass whitelist checks...
CVE-2026-63650: Improper Certificate Validation
OpenVPN 2.7alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field...
CVE-2026-19744 Stored Cross-site Scripting in Pentestify Markdown renderer via unescaped quotes
Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's href attribute because the renderer's sanitization...
CVE-2026-19744 Stored Cross-site Scripting in Pentestify Markdown renderer via unescaped quotes
Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's href attribute because the renderer's sanitization...
PT-2026-71005
The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated users such as Subscribers to create crowdfunding campaign posts despite not being granted that permission...
CVE-2026-73285: Incorrect Authorization
RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by RUSTFSPOLICYPLUGINURL in crates/iam/src/sys.rs sets PreparedIamAuth.needsexistingobjecttag incorrectly for PreparedIamMode::Opa, causing...
EUVD-2026-56147
Cross-site Scripting in the finding renderer in maalfer Pentestify before 2.3.1 allows authenticated users to execute arbitrary JavaScript in the application origin via HTML markup stored in a finding's severity field, which the frontend interpolates unescaped into class and style attributes when...
CVE-2026-73155: Missing Authorization
Affected versions of cti-transmute allow authenticated users to add or remove emoji reactions on comments without first checking whether those users are authorized to view the target comment. The vulnerable react handler passed an attacker-controlled commentid directly to...
CVE-2026-72555: Improper Access Control
A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 exists because the Config.rolesactive flag defaults to false, causing all permission checks on ticket, client, and user handlers to behave as no-ops on default installations. All authenticated users bypass...
CVE-2026-19434: Improper Neutralization of Input During Web Page Generation
Cross-site Scripting in the finding renderer in maalfer Pentestify before 2.3.1 allows authenticated users to execute arbitrary JavaScript in the application origin via HTML markup stored in a finding's severity field, which the frontend interpolates unescaped into class and style attributes when...