1253 matches found
EUVD-2026-97830
Nginx UI OTP secure-session step-up is missing on sensitive mutation routes...
CVE-2026-104021
The Fastcache by Host.it plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.7.4 via the fastcachesettingscachecookieexclude parameter. This is due to the plugin registering the cachecookieexclude setting via registersetting without a sanitizecallback, whi...
EUVD-2026-96068
The Fastcache by Host.it plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.7.4 via the fastcachesettingscachecookieexclude parameter. This is due to the plugin registering the cachecookieexclude setting via registersetting without a sanitizecallback, whi...
kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink
A flaw was found in the Linux kernel's VXLAN Virtual Extensible LAN implementation. A local attacker, with CAPNETADMIN network administration capability in one network namespace, could exploit an incorrect privilege check in the rtnl changelink path. This allows the attacker to modify the...
EUVD-2026-81023
CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to perform state-changing actions on behalf of authenticated operators. Attackers can craft hidden forms that submit to destructive endpoints like topic deletion and cluster configuration changes,...
PT-2026-94037
Name of the Vulnerable Software and Affected Versions CMAK versions prior to 3.0.0.7 Description The software fails to install a cross-site request forgery CSRF filter, which is a mechanism used to prevent unauthorized commands from being transmitted from a user that the web application trusts...
CVE-2026-89054
CVE-2026-89054 is a missing authorization vulnerability in OpenNMS Horizon . The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH , leaving the shipped @PATCH endpoints for event configuration and SNMP data collection accessible withou...
CVE-2026-89054 OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changes
A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration a...
CVE-2026-89054 OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changes
A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration a...
CVE-2026-89054 OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changes
A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration a...
EUVD-2026-69724
WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the getdomain and isSameDomain functions that fail to properly validate referer origins. Attackers can forge requests from sibling subdomains or unparseable long-gTLD origins to perform administrative...
CVE-2026-84482 WWBN AVideo Cross-Site Request Forgery via get_domain() validation
WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the getdomain and isSameDomain functions that fail to properly validate referer origins. Attackers can forge requests from sibling subdomains or unparseable long-gTLD origins to perform administrative...
CVE-2026-73707 Authenticated Privilege Escalation via Broken Access Control in HPE Networking Fabric Composer API
Privilege escalation vulnerabilities exist in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to complete state-changing actions that should not be allowed by their current level of authorization on the platform, includin...
CVE-2026-73707 Authenticated Privilege Escalation via Broken Access Control in HPE Networking Fabric Composer API
Privilege escalation vulnerabilities exist in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to complete state-changing actions that should not be allowed by their current level of authorization on the platform, includin...
CVE-2026-73707: Incorrect Authorization
Privilege escalation vulnerabilities exist in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to complete state-changing actions that should not be allowed by their current level of authorization on the platform, includin...
PT-2026-84410
Name of the Vulnerable Software and Affected Versions HPE Networking Fabric Composer affected versions not specified Description A flaw in the API allows an unauthenticated remote attacker to retrieve limited system information and modify the state of specific settings. This could enable an...
EUVD-2026-67284
The Ebyte device does not adequately verify the origin or authenticity of requests submitted to the web management interface. An unauthenticated remote attacker could persuade an authenticated administrator to visit a crafted page, causing unauthorized configuration changes or a disruption of...
CVE-2026-75814
The Ebyte device does not adequately verify the origin or authenticity of requests submitted to the web management interface. An unauthenticated remote attacker could persuade an authenticated administrator to visit a crafted page, causing unauthorized configuration changes or a disruption of...
CVE-2026-75548 Ebyte NA111-M Improper Restriction of Rendered UI Layers or Frames
The affected Ebyte device web management interface does not restrict the interface from being rendered within an external frame. An unauthenticated remote attacker could use a crafted webpage to mislead an authenticated administrator into initiating unintended configuration changes or disruptive...
CVE-2026-75548
CVE-2026-75548 affects the web management interface of the Ebyte NE2-D11 device. The interface lacks a frame-restriction mechanism (e.g., X-Frame-Options or CSP frame-ancestors), allowing an unauthenticated remote attacker to embed the interface within a crafted external page. This enables a clic...