57423 matches found
CVE-2026-16072
creationtimestamp| type| source ---|---|--- 2026-07-17 18:05:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqudn6gv5x2s...
CVE-2026-14871
creationtimestamp| type| source ---|---|--- 2026-07-17 17:57:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqud7ma5eq2g...
CVE-2026-48010 Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, UserController::upsertUser in src/Core/Framework/Api/Controller/UserController.php writes raw user data in SYSTEMSCOPE without filtering the admin field, so a non-admin API user with user:create or user:update ACL permission...
EUVD-2026-45237
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a non-admin API user with integration:create ACL privilege can escalate to full administrator by creating an integration with admin: true through the Sync API POST /api/action/sync; the regular integration endpoint POST...
CVE-2026-48008 Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a non-admin API user with integration:create ACL privilege can escalate to full administrator by creating an integration with admin: true through the Sync API POST /api/action/sync; the regular integration endpoint POST...
EUVD-2026-45235
IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to create unlimited user accounts on any Langflow instance; when NEWUSERISACTIVE=true documented deployment option, newly created accounts are immediately active and can authenticate to reach RCE endpoints, bypassing the need...
CVE-2026-8297
creationtimestamp| type| source ---|---|--- 2026-07-17 17:16:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mquav5hp4i2y 2026-07-17 18:58:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqugmuo42o2e 2026-07-19 08:00:51+00:00| seen|...
CVE-2026-51080
creationtimestamp| type| source ---|---|--- 2026-07-17 17:16:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mquav44jac2z 2026-07-17 17:46:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mquclsxilq2x 2026-07-19 11:00:30+00:00| seen|...
CVE-2026-9537
creationtimestamp| type| source ---|---|--- 2026-07-17 16:14:23+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqu5gsgzgx2n...
CVE-2026-38753
creationtimestamp| type| source ---|---|--- 2026-07-17 16:03:14+00:00| seen| https://bsky.app/profile/bootintel.bsky.social/post/3mqu4stvt3e2e...
CVE-2026-16008
creationtimestamp| type| source ---|---|--- 2026-07-17 14:50:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqtyr7zbnw2q...
CVE-2026-9602
creationtimestamp| type| source ---|---|--- 2026-07-17 14:30:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqtxnfdv6n2i...
CVE-2026-22104
creationtimestamp| type| source ---|---|--- 2026-07-17 14:13:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqtwoapfly2x...
CVE-2026-56171
creationtimestamp| type| source ---|---|--- 2026-07-17 14:00:06+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mqtvwo4v522y 2026-07-17 14:00:11+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mqtvwt7bfv2z 2026-07-17 19:29:06+00:00| seen|...
CVE-2026-13410
creationtimestamp| type| source ---|---|--- 2026-07-17 13:48:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqtvcqexnt26 2026-07-17 14:15:00+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqtwrcngnu2n 2026-07-19 12:01:05+00:00| seen|...
Improper Enforcement Of Security Policy
github.com/forgekeep/nebula-mesh is vulnerable to Improper Enforcement of Security Policy. The vulnerability is due to the Web UI host-creation endpoint hardcoding a 24-hour enrollment token lifetime instead of enforcing the configured server-wide or per-network enrollment token TTL, which allows...
CVE-2026-16072
CVE-2026-16072 affects Keycloak’s organization management component. A delegated administrator with org-management permissions can create an invitation for a non-existent email address and then fetch the secret registration link via the API, enabling creation of new user accounts and their additi...
CVE-2026-15395
creationtimestamp| type| source ---|---|--- 2026-07-17 12:12:29+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mqtpwagzup2v 2026-07-17 12:12:46+00:00| seen| https://mastodon.social/users/hugovalters/statuses/116935253395484489...