46417 matches found
CVE-2026-1199
Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing for more password guesses than intended...
CVE-2026-1199 API and Frontend login lockout race condition
Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing for more password guesses than intended...
EUVD-2026-60733
Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing for more password guesses than intended...
CVE-2026-1199
Zabbix API and Frontend login lockout mechanism has a race condition: simultaneous failed login requests are not properly counted toward the block counter, allowing more password guesses than intended. CVSS 4.0 base score 6.9 (MEDIUM), network-accessible, no privileges required. Nessus flags it a...
libssh security update
An update is available for libssh. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list libssh is a library which implements the SSH protocol. It can be used to...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.21.29 bug fix and security update
Red Hat OpenShift Container Platform release 4.21.29 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.21. Red Hat Product Security has rated this update as having a...
EUVD-2026-60614
ArcadeDB's Gremlin wire-protocol plugin com.arcadedb:arcadedb-gremlin in versions = 26.7.3 enforces authentication SASL PLAIN but performs no authorization: it never checks database access permissions canAccessToDatabase and never binds the authenticated principal into the engine. As a result, an...
CVE-2026-75851 ArcadeDB before 26.8.1 Authentication Bypass via Async Command
ArcadeDB server com.arcadedb:arcadedb-server in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user,...
CVE-2026-75852
ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials. CVSS 9.8 (Critical)...
CVE-2026-75852 ArcadeDB MongoDB wire protocol authentication bypass cross-database
ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials...
CVE-2026-75852 ArcadeDB MongoDB wire protocol authentication bypass cross-database
ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials...
CVE-2026-75851 ArcadeDB before 26.8.1 Authentication Bypass via Async Command
ArcadeDB server com.arcadedb:arcadedb-server in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user,...
CVE-2026-75843 ArcadeDB before 26.8.1 Privilege Escalation via gRPC Transaction
ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers can execute executeCommand with a transaction ID to run...
CVE-2026-75627
Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrative controllers to read user listings, create manager...
CVE-2026-75627 Bastillion Authentication Bypass via Path-Prefix Routing Mismatch
Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrative controllers to read user listings, create manager...
CVE-2026-75627 Bastillion Authentication Bypass via Path-Prefix Routing Mismatch
Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrative controllers to read user listings, create manager...
EUVD-2026-60578
Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrative controllers to read user listings, create manager...
CVE-2026-75627
Bastillion's controller dispatcher (BaseKontroller.java) fails to validate request URI paths, allowing unauthenticated attackers to bypass authentication filters by prefixing arbitrary path segments. This grants access to administrative controllers to read user listings, create manager accounts, ...
