14393 matches found
CVE-2026-73849
Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=reinstall without authentication and deliberately skips the already-installed check because the guard runs only when $act != 'reinstall'. A remote attacker can submit hostname, dbuser, dbpasswd,...
CVE-2026-73849
Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=reinstall without authentication and deliberately skips the already-installed check because the guard runs only when $act != 'reinstall'. A remote attacker can submit hostname, dbuser, dbpasswd,...
CVE-2026-73849
In CVE-2026-73849, Emlog (2.6.26 and earlier) allows unauthenticated reinstall via install.php?action=reinstall. The code path bypasses the already-installed guard when act != 'reinstall', letting a remote attacker submit hostname, dbuser, dbpasswd, dbname, dbprefix, username, password, and email...
CVE-2026-73849 emlog allows unauthenticated reinstallation via `install.php?action=reinstall`.
Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=reinstall without authentication and deliberately skips the already-installed check because the guard runs only when $act != 'reinstall'. A remote attacker can submit hostname, dbuser, dbpasswd,...
CVE-2026-73849 emlog allows unauthenticated reinstallation via `install.php?action=reinstall`.
Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=reinstall without authentication and deliberately skips the already-installed check because the guard runs only when $act != 'reinstall'. A remote attacker can submit hostname, dbuser, dbpasswd,...
CVE-2026-72830
Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. Attackers with a scoped api.config.write key can inject arbitrary commands into scheduler.customjobs that execute via Symfony...
CVE-2026-72830
Grav API plugin versions prior to 1.0.13 are vulnerable to remote code execution due to a failure to enforce API key scope caps in ConfigController super-scope gates. While requirePermission() correctly enforces caps, the scheduler and backups gates utilize a bare isSuperAdmin() check that ignore...
CVE-2026-72830 Grav API Plugin before 1.0.13 RCE via ConfigController scope bypass
Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. Attackers with a scoped api.config.write key can inject arbitrary commands into scheduler.customjobs that execute via Symfony...
GO-2025-3955 vulnerabilities
Vulnerabilities for packages: kapp, azure-service-operator, nuclei, cilium-cli, ipfs-cluster, nginx-prometheus-exporter, clickhouse-operator, mongo-tools, helm-set-status, cni-plugins, kor, gobuster, k3d, glow, terraform, containerd, steampipe, nri-f5, witness, nri-redis, opa, regclient,...
CVE-2026-19617 Libdm: lvm2: libdm: denial of service via uncontrolled recursion in config parser
A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager LVM metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the...
CVE-2026-19617 Libdm: lvm2: libdm: denial of service via uncontrolled recursion in config parser
A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager LVM metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the...
CVE-2026-19617
CVE-2026-19617 affects libdm (LVM2). A remote attacker can craft a deeply nested LVM metadata configuration that triggers uncontrolled recursion in the libdm configuration parser, exhausting the stack and causing DoS for any LVM command reading the metadata. Documented impact is Denial of Service...
PT-2026-72078
Name of the Vulnerable Software and Affected Versions Zephyr affected versions not specified Description A use-after-free issue exists in the dynamic kernel-object disposal path unref check within kernel/userspace/userspace.c. The system frees an object's storage using k freedyn-data when its...
PT-2026-72123
Name of the Vulnerable Software and Affected Versions OpenVPN versions 2.4.0 through 2.6.21 OpenVPN versions 2.7 alpha1 through 2.7.5 Description The Windows interactive service allows local authenticated users to bypass the trusted configuration directory constraint. This is achieved by using...
The vulnerability of the Enterprise Config Management component of the Oracle Enterprise Manager Base Platform allows a perpetrator to gain full control over the application.
The vulnerability of the Enterprise Config Management component of the Oracle Enterprise Manager Base Platform is related to improper authentication. Exploiting this vulnerability can allow a malicious actor to gain full control over the application using the HTTPS protocol...
CVE-2026-72857
Budibase before 3.40.0 has a credential exposure weakness: it does not redact credentials stored in STRING fields, enabling authenticated users with table read permissions to read MongoDB connection strings and Firebase private keys via the read API, effectively exposing live backend credentials ...
CVE-2026-54481
Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override CWE-295...
EUVD-2026-58137
Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override CWE-295...