Lucene search
+L

173018 matches found

Positive Technologies
Positive Technologies
added 2026/08/28 12:00 a.m.10 views

PT-2026-83116

A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user, the ext.cattle.io/v1 Token store dropped its internal owner filter instead of returning an empty result. Any authenticated user could therefore list and watch every other user'...

7.7CVSS5.2AI score
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/08/28 12:00 a.m.15 views

PT-2026-83289

Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with admin api require auth defaulting to false, treating unauthenticated requests as superusers. Attackers can reach port 9644 without credentials to create and delete broker accounts, modify cluster configuration, and disrupt partition...

9.8CVSS5.9AI score0.00336EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/08/28 12:00 a.m.13 views

PT-2026-83348

Name of the Vulnerable Software and Affected Versions MariaDB Connector/Node.js versions prior to 3.2.4 MariaDB Connector/Node.js versions prior to 3.3.3 MariaDB Connector/Node.js versions prior to 3.4.6 MariaDB Connector/Node.js versions prior to 3.5.3 Description MariaDB Connector/Node.js can...

5.9CVSS5.9AI score0.00278EPSS
SaveExploits0References20
Positive Technologies
Positive Technologies
added 2026/08/28 12:00 a.m.13 views

PT-2026-83362

Name of the Vulnerable Software and Affected Versions MongoDB Connector for BI affected versions not specified Description An unauthenticated network-reachable client can cause resource exhaustion by initiating a SASL-based login exchange and failing to complete it. Because the negotiation loop...

8.7CVSS5.9AI score0.00239EPSS
SaveExploits0References3
Tenable Nessus
Tenable Nessus
added 2026/08/28 12:00 a.m.14 views

openSUSE 16 Security Update : trivy (openSUSE-SU-2026:21645-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21645-1 advisory. This update for trivy fixes the following issue: - CVE-2026-72815,CVE-2026-72816,CVE-2026-72817: github.com/go-chi/chi/v5: multiple IP spoofing...

6.9CVSS6AI score0.00397EPSS
SaveExploits0References7
UbuntuCve
UbuntuCve
added 2026/08/28 12:00 a.m.7 views

CVE-2026-73208

An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the audience claim is used in its place and checked against the configured required scopes. These are different concepts, and the audience claim...

7.4CVSS7.1AI score0.00256EPSS
SaveExploits0References1
UbuntuCve
UbuntuCve
added 2026/08/28 12:00 a.m.8 views

CVE-2026-40205

An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is required in the configuration, the remote token validation paths accept a token that carries only one of them, while the local token validation path correctly...

5.9CVSS7.1AI score0.00179EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
added 2026/08/28 12:00 a.m.11 views

VulnCheck KEV: CVE-2026-82329

JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges...

9.8CVSS5.9AI score0.07666EPSS
SaveIn wildExploits6References6
OSV
OSV
added 2026/08/28 12:00 a.m.6 views

UBUNTU-CVE-2026-42008

Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without...

4.3CVSS7.1AI score0.00193EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/08/28 12:00 a.m.11 views

PT-2026-83135

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A flaw exists where the source-address critical option in the Permissions returned by certain authentication callbacks is not validated against the client's remo...

7.5CVSS6AI score0.00325EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/08/28 12:00 a.m.11 views

PT-2026-83373

Name of the Vulnerable Software and Affected Versions MariaDB Connector/J versions prior to 2.7.14 MariaDB Connector/J versions prior to 3.3.5 MariaDB Connector/J versions prior to 3.4.3 MariaDB Connector/J versions prior to 3.5.9 Description When using PAM dialog authentication, the connector ca...

5.9CVSS5.8AI score0.00197EPSS
SaveExploits0References12
Positive Technologies
Positive Technologies
added 2026/08/28 12:00 a.m.15 views

PT-2026-83074

Name of the Vulnerable Software and Affected Versions Dovecot versions prior to 2.4.5-1.1 Description An authentication flaw exists where a token intended for a different purpose can be used to authenticate. This occurs when an OAuth2 token response lacks a scope claim, causing the system to use...

7.4CVSS7AI score0.00256EPSS
SaveExploits0References55
Cvelist
Cvelist
added 2026/08/27 11:26 p.m.31 views

CVE-2026-78103 Dimension Log Server Configuration Lock Bypass Vulnerability

WatchGuard Dimension provides a client-side lock/unlock UI control for management changes. The server-side configuration endpoint does not enforce this lock/unlock workflow state, allowing an authenticated administrator to submit configuration changes directly to the endpoint without first...

5.1CVSS0.00291EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/27 11:26 p.m.8 views

CVE-2026-78617

WatchGuard Dimension 's web login endpoint does not enforce effective rate-limiting or account lockout by default, allowing a remote attacker to perform automated password guessing (brute-force) against user accounts. The root cause is the absence of default protections against repeated authentic...

6.3CVSS5.4AI score0.00323EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/27 11:26 p.m.34 views

CVE-2026-78617 WatchGuard Dimension Web UI Authentication Brute-Force Due to Missing Rate Limiting

WatchGuard Dimension's web login endpoint does not enforce effective rate-limiting or account lockout by default allowing a remote attacker to perform automated password guessing against user accounts. If the account lockout setting is enabled, brute-force attempts are blocked after a defined...

6.3CVSS0.00323EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/08/27 11:24 p.m.13 views

CVE-2026-19315 Fireware OS Pre-Authentication Type Confusion in iked Allows Remote Code Execution

A type confusion vulnerability in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic...

9.3CVSS6.2AI score0.00457EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/08/27 11:24 p.m.12 views

CVE-2026-19317 Fireware OS Pre-Authentication Out-of-Bounds Read in iked Allows Denial of Service (DoS)

An out-of-bounds read vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service DoS condition in VPN processing by sending specially crafted network traffic...

8.7CVSS6AI score0.00322EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/27 11:24 p.m.35 views

CVE-2026-19317 Fireware OS Pre-Authentication Out-of-Bounds Read in iked Allows Denial of Service (DoS)

An out-of-bounds read vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service DoS condition in VPN processing by sending specially crafted network traffic...

8.7CVSS0.00322EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/27 11:24 p.m.40 views

CVE-2026-19315 Fireware OS Pre-Authentication Type Confusion in iked Allows Remote Code Execution

A type confusion vulnerability in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic...

9.3CVSS0.00457EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/27 11:24 p.m.125 views

CVE-2026-19315

A type confusion vulnerability in the iked process of WatchGuard Fireware OS allows a remote, unauthenticated attacker to achieve arbitrary code execution by sending specially crafted network traffic. The vulnerability is rated CVSS 4.0 9.3 (CRITICAL) , reflecting a network attack vector with low...

9.3CVSS5.9AI score0.00457EPSS
SaveExploits0References1
Rows per page
Query Builder