277627 matches found
netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation
A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected...
EUVD-2026-89483
LightLLM through 1.2.0 contains a memory exhaustion vulnerability in the NCCL control channel when started with --pdtransmode nccl, allowing unauthenticated attackers to exhaust KV-transfer worker memory. Attackers can call the exposedsetvalue method to store unbounded key-value pairs without siz...
[SECURITY] Fedora 45 Update: gnome-control-center-51.0-1.fc45
This package contains configuration utilities for the GNOME desktop, which allow to configure accessibility options, desktop fonts, keyboard and mouse properties, sound setup, desktop theme and background, user interface properties, screen resolution, and other settings...
CVE-2026-51867
agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on tha...
CVE-2026-102147: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting XSS weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript in the authenticated session of an administrator who views the affected page. This could have permitted the attacker to gain full...
CVE-2026-102146: External Control of File Name or Path
An authenticated Email Protection Gateway administrator holding only limited, delegated permissions could write files with attacker-controlled content to arbitrary locations accessible to the Email Protection Gateway service account. This exceeds the administrator's intended privileges and could ...
CVE-2026-102397: Missing Authorization
Unauthenticated Broken Access Control in Ultimate Maps by Supsystic = 1.5.5 versions...
CVE-2026-102375: Missing Authorization
Missing Authorization vulnerability in Optimole Optimole optimole-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Optimole: from n/a through 4.2.14...
CVE-2026-55181: Improper Access Control
Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.3, Tugtainer's OIDC authentication can still be initiated even when OIDCENABLED=false. The /auth/oidc/enabled endpoint correctly reports that OIDC is disabled. However, a direct request to...
CVE-2026-97243: Missing Authorization
Subscriber Broken Access Control in AllAble Connector = 0.13.4 versions...
CVE-2026-89190: Improper Access Control
The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one of its bundled admin framework's request handlers, allowing users with a subscriber-level account to render admin-only Robin Image Optimizer WordPress plugin before 2.0.8 pages an...
CVE-2026-86556: Improper Privilege Management
There is an information disclosure vulnerability in ZTE U30 Air. Due to improper permission control, attackers can exploit the vulnerability to obtain relevant information...
ROS-20260930-73-0089
The vulnerability in the kernel-lt is related to access control deficiencies. Exploiting this vulnerability can allow an attacker to enhance their privileges...
ROS-20260930-73-0087
The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...
ROS-20260930-73-0080
The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...
PT-2026-103486
šØ CVE-2026-102375 Missing Authorization vulnerability in Optimole Optimole optimole-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Optimole: from n/a through 4.2.14. š@cveNotify...
PT-2026-103580
Name of the Vulnerable Software and Affected Versions Kiteworks Core affected versions not specified Description A stored cross-site scripting XSS weakness allows an unauthenticated attacker to store crafted content. This content executes arbitrary JavaScript within the authenticated session of a...
PT-2026-103177
Subscriber Broken Access Control in FormGent = 1.12.2 versions...