263826 matches found
CVE-2026-105806 Payload: Improper access control for MCP API keys
Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation through account takeover. This issue is fixed in version...
CVE-2026-9254
TP-Link Archer BE800 V1 — Parental Control LAN RCE CVE: CVE-2026-9254 CVSS: 8.7 High Auth required: None Network position: LAN only Found on version 1.3.2 Build 20251015 rel.106595553 Summary The parental control blocking endpoint /cgi-bin/luci/blocking?form=vercode is reachable from the LAN...
CVE-2026-70411
Dell Container Storage Modules (CSM) versions prior to 1.18.0 are vulnerable to a Missing Authentication for Critical Function vulnerability within the csm-authorization-tenant gRPC service (TenantService) . An unauthenticated attacker positioned on an adjacent network could exploit this flaw to ...
CVE-2026-82924
Improper Control of Interaction Frequency vulnerability in Pusula Communication, IT, and Internet Industry and Trade Co. Ltd. Expert Mail allows Brute Force. This issue affects Expert Mail: through 2026-09-18...
EUVD-2026-93415
Improper Control of Interaction Frequency vulnerability in Pusula Communication, IT, and Internet Industry and Trade Co. Ltd. Expert Mail allows Brute Force. This issue affects Expert Mail: through 2026-09-18...
CVE-2026-82924 PII Enumeration via Missing Rate Limiting in Pusula Communication's Expert Mail
Improper Control of Interaction Frequency vulnerability in Pusula Communication, IT, and Internet Industry and Trade Co. Ltd. Expert Mail allows Brute Force. This issue affects Expert Mail: through 2026-09-18...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.22.17 bug fix and security update
Red Hat OpenShift Container Platform release 4.22.17 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.22. Red Hat Product Security has rated this update as having a...
Exploit for Missing Authentication for Critical Function in Gfi Kerio_Control
!WARNING DISCLAIMER This proof-of-concept is provide...
Null Byte Injection
Netty is vulnerable to null byte injection. The vulnerability is due to the MqttEncoder not validating client identifiers, topics, usernames, and PUBLISH topic names before encoding, where prohibited null bytes can be inserted into MQTT UTF-8 string fields and attackers can exploit this by...
CVE-2026-105985
Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding...
CVE-2026-105985 Authenticated RCE via render-components Entry Type overrides
Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding...
EUVD-2026-93362
Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding...
CVE-2026-105985
Craft CMS 5.10.13.2 is vulnerable to authenticated remote code execution (RCE) within the Control Panel's app/render-components action. An authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides to manipulate an EntryType object's ...
CVE-2026-105985 Authenticated RCE via render-components Entry Type overrides
Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding...
CVE-2026-105985 Authenticated RCE via render-components Entry Type overrides
Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding...
Security Bulletin: Vulnerabilities exists in IBM Cloud Pak for Data System (Yosemite 1.0)
Summary Vulnerabilities identified in IBM Cloud Pak for Data System Yosemite 1.0 - NRS have been addressed in version 3.0.5.4 Vulnerability Details CVEID:CVE-2026-62574 DESCRIPTION: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Ja...
CVE-2026-95526
Unauthenticated Broken Access Control in BEAR = 1.2.2 versions...
CVE-2026-62072
Subscriber Broken Access Control in Progress Planner = 1.10.0 versions...