46416 matches found
CVE-2026-16835 Power System Improper Certificate Validation
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP management network protocol. An unauthenticated attacker on the management network can bypass authentication and perform any...
CVE-2026-16835 Power System Improper Certificate Validation
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP management network protocol. An unauthenticated attacker on the management network can bypass authentication and perform any...
CVE-2026-73136
Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated third party to obtain paid resources by replaying a transfer settled by an unrelated payer. MPP.Methods.Tempo normally binds a settled TIP-20 TransferWithMemo to the specific challenge under verification through an...
CVE-2026-67581
Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated remote client to obtain paid resources by resubmitting one settled on-chain transfer. MPP.Methods.EVM.verify/2 accepts a transaction-hash credential and matches a transfer purely on token, to and amount ERC-20 or to...
CVE-2026-66794
A flaw was found in the cluster-proxy-addon component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy...
CVE-2026-49870 Snipe-IT: TOTP Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`
Snipe-IT is an IT asset/license management system. Prior to 8.6.1, POST /two-factor has no rate limiting, lockout, or attempt counter, allowing an attacker with valid credentials to submit unlimited TOTP guesses against the three accepted codes created by config/google2fa.php window=1. A successf...
CVE-2026-49870
In Snipe-IT before v8.6.0, the POST /two-factor endpoint lacked rate limiting, lockout, or attempt counters, allowing an attacker with valid credentials to brute-force TOTP codes (3 of 1,000,000 accepted due to window=1). A successful guess grants a full authenticated session. In optional 2FA mod...
CVE-2026-49870 Snipe-IT: TOTP Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`
Snipe-IT is an IT asset/license management system. Prior to 8.6.1, POST /two-factor has no rate limiting, lockout, or attempt counter, allowing an attacker with valid credentials to submit unlimited TOTP guesses against the three accepted codes created by config/google2fa.php window=1. A successf...
CVE-2026-61281
creationtimestamp| type| source ---|---|--- 2026-08-19 17:52:41+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...
CVE-2026-70904
creationtimestamp| type| source ---|---|--- 2026-08-19 17:52:24+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...
CVE-2026-70914
creationtimestamp| type| source ---|---|--- 2026-08-19 17:51:44+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...
CVE-2026-70957
creationtimestamp| type| source ---|---|--- 2026-08-19 17:49:55+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...
CVE-2026-70973
creationtimestamp| type| source ---|---|--- 2026-08-19 17:47:59+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...
CVE-2026-61276
creationtimestamp| type| source ---|---|--- 2026-08-19 17:46:46+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...
CVE-2026-66794 Cluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public route
A flaw was found in the cluster-proxy-addon component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy...
EUVD-2026-62598
A flaw was found in the cluster-proxy-addon component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy...
CVE-2026-66794
A flaw was found in the cluster-proxy-addon component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy...
GDBusServer: glib2: GDBusServer pre-authentication DoS via unbounded SASL line buffering
A denial-of-service and resource exhaustion vulnerability exists within the GDBus component of GLib. The gdbusauth authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input...