4065 matches found
CVE-2026-50770
An issue in Squirro Cognitive Search before v.3.14.2 allows a remote attacker to escalate privileges via a crafted request...
CVE-2026-13267
CVE-2026-13267 affects IBM Security Verify Access and IBM Verify Identity Access (and their containers): authenticated users could escalate privileges to those of another user via a specially crafted request. Affected: IBM Security Verify Access 10.0–10.0.9.2; IBM Verify Identity Access 11.0–11.0...
CVE-2026-13267
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 could allow an authenticated user to gain privileges of another user via a specially crafted request...
EUVD-2026-57539
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 could allow an authenticated user to gain privileges of another user via a specially crafted request...
CVE-2026-19311
Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters...
EUVD-2026-55618
Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no...
SUSE CVE-2026-68742
A flaw was found in SSSD. The sssnssprotocolparseaddr function in the NSS responder does not validate the addrlen field against the remaining packet body size. A local attacker can exploit this via a crafted GETHOSTBYADDR request to the NSS responder socket, causing an out-of-bounds read and...
CVE-2026-69093
Admidio before 5.0.11 does not validate the admcsrftoken in modules/category-report/preferences.php, which performs persistent Category Report configuration changes based on GET parameters delete and copy. An attacker can trick an authenticated administrator into visiting a crafted URL to delete ...
CVE-2026-68742
A flaw was found in SSSD. The sssnssprotocolparseaddr function in the NSS responder does not validate the addrlen field against the remaining packet body size. A local attacker can exploit this via a crafted GETHOSTBYADDR request to the NSS responder socket, causing an out-of-bounds read and...
PT-2026-67436
Name of the Vulnerable Software and Affected Versions Krayin CRM version 2.2.4 Description Missing authentication in the installer middleware allows unauthenticated remote attackers to overwrite the primary administrator account. By sending a crafted HTTP POST request containing the...
CVE-2026-51785
An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary code via a crafted request...
CVE-2026-51785
CVE-2026-51785 affects Hugo Leisink Hiawatha prior to 12.2. The incident is a remote code execution vulnerability triggered by a crafted request to the server. The available connected documents confirm the flaw and the affected version range, with remediation guidance to upgrade to version 12.2 o...
CVE-2026-51785
An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary code via a crafted request...
PT-2026-66858
Name of the Vulnerable Software and Affected Versions Hugo Leisink Hiawatha versions prior to 12.2 Description A flaw allows a remote attacker to execute arbitrary code by sending a specially crafted request to the server. Recommendations Update Hugo Leisink Hiawatha to version 12.2 or later...
CVE-2026-9322
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 are vulnerable to a denial of service via a crafted HTTP request...
CVE-2026-11897
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources...
PT-2026-66403
Name of the Vulnerable Software and Affected Versions PCP Performance Co-Pilot pmproxy service affected versions not specified Description A flaw in the pmproxy service allows a remote attacker to send a specially crafted request to the pmLogLoadInDom function. This action bypasses a critical...
PT-2026-66532
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 are vulnerable to a denial of service via a crafted HTTP request...
CVE-2026-8338
The CVE describes a Spring Security authentication and authorization bypass in Coverity Connect versions 2023.6.0–2026.3.0. An unauthenticated attacker can send a specially crafted HTTP request to bypass authentication/authorization on certain API endpoints and access data within Coverity. CVSS 4...