CVE-2026-17333

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass authentication and inject unauthorized configuration changes due to improper certificate validation...

CVE-2026-17333

The software IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are affected by multiple vulnerabilities. These issues stem from improper certificate validation , which could enable a remote attacker to bypass authentication and inject unauthorized configuration cha...

EUVD-2026-118724

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass authentication and inject unauthorized configuration changes due to improper certificate validation...

CVE-2026-17333 Multiple Vulnerabilities in IBM API Connect

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass authentication and inject unauthorized configuration changes due to improper certificate validation...

CVE-2026-17333 Multiple Vulnerabilities in IBM API Connect

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass authentication and inject unauthorized configuration changes due to improper certificate validation...

CVE-2026-17333: IBM API Connect: IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass…

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass authentication and inject unauthorized configuration changes due to improper certificate validation...

CVE-2026-122151

A flaw was found in Presenton. Due to improper request handling in the user configuration component, a remote attacker can trick an authenticated user into submitting an unauthorized request. This Cross-Site Request Forgery CSRF vulnerability allows an attacker to alter the victim's configuration...

CVE-2026-115708

A flaw was found in Elastic Cloud Enterprise ECE. This vulnerability allows a local attacker to bypass authentication controls and make unauthorized configuration changes to other deployments on the same host. By conducting a symbolic link symlink attack, where a file shortcut is used to redirect...

CVE-2026-95716 Authentication Bypass in the PAPI Protocol of AOS-10 allows Unauthorized Configuration Changes

An authentication bypass in the PAPI protocol of AOS-10 allows an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation allows an attacker to change the state of certain settings of a vulnerable system...

CVE-2026-95716 Authentication Bypass in the PAPI Protocol of AOS-10 allows Unauthorized Configuration Changes

An authentication bypass in the PAPI protocol of AOS-10 allows an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation allows an attacker to change the state of certain settings of a vulnerable system...

EUVD-2026-97830

Nginx UI OTP secure-session step-up is missing on sensitive mutation routes...

CVE-2026-104021

The Fastcache by Host.it plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.7.4 via the fastcachesettingscachecookieexclude parameter. This is due to the plugin registering the cachecookieexclude setting via registersetting without a sanitizecallback, whi...

EUVD-2026-96068

The Fastcache by Host.it plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.7.4 via the fastcachesettingscachecookieexclude parameter. This is due to the plugin registering the cachecookieexclude setting via registersetting without a sanitizecallback, whi...

kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink

A flaw was found in the Linux kernel's VXLAN Virtual Extensible LAN implementation. A local attacker, with CAPNETADMIN network administration capability in one network namespace, could exploit an incorrect privilege check in the rtnl changelink path. This allows the attacker to modify the...

EUVD-2026-81023

CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to perform state-changing actions on behalf of authenticated operators. Attackers can craft hidden forms that submit to destructive endpoints like topic deletion and cluster configuration changes,...

PT-2026-94037

Name of the Vulnerable Software and Affected Versions CMAK versions prior to 3.0.0.7 Description The software fails to install a cross-site request forgery CSRF filter, which is a mechanism used to prevent unauthorized commands from being transmitted from a user that the web application trusts...

CVE-2026-89054 OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changes

A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration a...

CVE-2026-89054

CVE-2026-89054 is a missing authorization vulnerability in OpenNMS Horizon . The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH , leaving the shipped @PATCH endpoints for event configuration and SNMP data collection accessible withou...

CVE-2026-89054 OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changes

A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration a...

CVE-2026-89054 OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changes

A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration a...