67814 matches found
CVE-2026-63587: Authentication Bypass Using an Alternate Path or Channel
The SMS control function of IE-SR-2TX-WL-4G devices can require a password for SMS commands via the 'Enable Password Authorization' setting. The device increments a retry counter on each failed SMS password attempt; after 5 consecutive failed attempts, SMS password authorization is automatically...
PT-2026-81194
FA-50 all versions miss authentication for some configuration. An attacker with access to the vessel's internal network can manipulate the product's settings screen to alter some configuration parameters...
CVE-2026-67578: Missing Authentication for Critical Function
FA-50 all versions miss authentication for some configuration. An attacker with access to the vessel's internal network can manipulate the product's settings screen to alter some configuration parameters...
PT-2026-81233
The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration, allowing self-service privilege escalation into arbitrary frontend groups...
PT-2026-81333
Name of the Vulnerable Software and Affected Versions JFrog Artifactory versions prior to 7.161.19 JFrog Artifactory versions prior to 7.146.36 Description An authenticated user with permissions to read an existing remote Version Control System VCS repository can trigger server-side requests. Thi...
PT-2026-81227
The SMS control function of IE-SR-2TX-WL-4G devices can require a password for SMS commands via the 'Enable Password Authorization' setting. The device increments a retry counter on each failed SMS password attempt; after 5 consecutive failed attempts, SMS password authorization is automatically...
PT-2026-81883
Faktory is a language-agnostic background job server. In versions prior to 1.10.0, the embedded Redis bootstrapper is vulnerable to an insecure temporary file flaw that lets a local unprivileged user hijack the Redis configuration and escalate to root. It writes its startup configuration to a...
PT-2026-81482
Name of the Vulnerable Software and Affected Versions Alluxio affected versions not specified Description The S3 REST proxy fails to verify AWS Signature Version 4 signatures when using the default configuration. This allows unauthenticated attackers to spoof user identity by extracting usernames...
PT-2026-81141
Name of the Vulnerable Software and Affected Versions Grav CMS versions prior to 2.0.16 Description Sandboxed Twig renders fail to filter system, site, and theme configuration arrays. This allows users with page-content edit access to read sensitive configuration values, such as cache credentials...
FreeBSD-SA-26:63.posixshm
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:63.posixshm Security Advisory The FreeBSD Project Topic: TOCTOU race in POSIX shared memory large page configuration Category: core Module: posixshm...
The vulnerability of the setup_lass() function in the arch/x86/kernel/cpu/common.c module, which is part of the Linux operating system’s x86 kernel support, allows a hacker to trigger a service failure.
The vulnerability of the setuplass function in the arch/x86/kernel/cpu/common.c module, which is part of the Linux operating system’s x86 kernel support, is related to errors in system configuration or settings. Exploiting this vulnerability can allow an attacker to cause a service failure...
Linux Distros Unpatched Vulnerability : CVE-2026-14457
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: In a server or client configuration with RFC7250 Raw Public Keys RPKs enabled, and only the private key with no associated certificate configured...
The vulnerability of the `bcma_mdio_mii_register()` function in the `drivers/net/ethernet/broadcom/bgmac-bcma-mdio.c` driver code of the Linux kernel’s Ethernet adapter support module allows a hacker to cause a service failure.
The vulnerability of the bcmamdiomiiregister function in the drivers/net/ethernet/broadcom/bgmac-bcma-mdio.c driver for supporting Ethernet network adapters in the Linux operating system is related to security configuration errors. Exploiting this vulnerability could allow an attacker to cause a...
The vulnerability of the current_value_store() function in the drivers/platform/x86/think-lmi.c module of the Linux operating system’s X86 device support driver allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the currentvaluestore function in the drivers/platform/x86/think-lmi.c module of the Linux kernel’s X86 device support driver lies in the fact that authentication data is stored in configuration files in an unencrypted form. Exploiting this vulnerability could allow an attack...
PT-2026-81350
Name of the Vulnerable Software and Affected Versions mcp-shell versions prior to 0.6.0 Description The software contains two security flaws that allow unrestricted operating system command execution. First, the security configuration is disabled by default when the MCP SHELL SEC CONFIG FILE...
PT-2026-81352
Name of the Vulnerable Software and Affected Versions mcp-shell versions prior to 0.6.0 Description An OS Command Injection issue exists in the shell exec MCP tool. The software implements a secure mode that restricts command execution to an allowlist of executables defined in security.yaml, whic...
CVE-2026-71933
Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple syslog functions. The vulnerability is caused by missing authorization checks. A remote attacker can trigger these vulnerabilities via crafted requests to modify configuration, restart services, save...
CVE-2026-76836
AzuraCast (through 0.23.8 ) allows a station manager holding only the Profile permission to write Liquidsoap custom configuration fields via PUT /api/station/{station_id}/profile/edit. The root cause is that the backend_config property is serialized under GROUP_GENERAL without field-level permiss...
EUVD-2026-64992
Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple syslog functions. The vulnerability is caused by missing authorization checks. A remote attacker can trigger these vulnerabilities via crafted requests to modify configuration, restart services, save...
CVE-2026-71933 DrayTek VigorSwitch Multiple Models Missing Authorization in Syslog Functions
Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple syslog functions. The vulnerability is caused by missing authorization checks. A remote attacker can trigger these vulnerabilities via crafted requests to modify configuration, restart services, save...