18642 matches found
EUVD-2026-57455
SiYuan: Embedded transclusion block content is returned without publish-access filtering, leaking private and password-protected document content to anonymous readers...
CVE-2026-85607
Blinko 1.8.7 contains an authorization bypass (IDOR) vulnerability in multiple tRPC procedures (message.list, message.update, message.delete, message.clearAfter in server/routerTrpc/message.ts and conversation.clearMessages in server/routerTrpc/conversation.ts). Although these procedures require ...
PT-2026-85556
Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods through getattr without allowlist validation. Unauthenticated attackers can register clients, instantiate Repo resources, and invoke arbitrary methods to read experiments or delete runs...
CVE-2026-85389
Worklenz before 3.0.0 fails to verify task ownership by organization when resolving task-scoped API endpoints, allowing authenticated users to access another tenant's task data. Attackers can query task endpoints with arbitrary task UUIDs to retrieve work logs, comments, attachments, and project...
CVE-2026-85093
Cheshire Cat AI (an open-source AI agent framework) contains an information disclosure vulnerability in its GET /memory/collections/{collection_id}/points endpoint. The root cause is a missing per-user filter when retrieving episodic memory points, allowing any authenticated user with MEMORY:READ...
CVE-2026-73755
A privilege escalation vulnerability exists in the API endpoint of AOS-CX. Successful exploitation could allow an authenticated low-privilege operator user, after a required user action, to access sensitive information from the vulnerable system...
CVE-2026-79685
Dell PowerStore is affected by an Argument Injection vulnerability. An authenticated user with limited privileges could exploit this to gain unauthorized access to sensitive system information , resulting in a High confidentiality impact with no integrity or availability impact (CVSS v3.1: 6.5 ME...
CVE-2026-81293
Unauthenticated SQL Injection in WP Data Access = 5.5.81 versions...
EUVD-2026-68780
Unauthenticated SQL Injection in WP Data Access = 5.5.81 versions...
CVE-2026-81293
CVE-2026-81293 is an unauthenticated SQL injection vulnerability in the WP Data Access WordPress plugin, affecting versions 5.5.81 and below . The flaw was discovered by sequence_X0 and reported via Patchstack. The CVSS v3.1 score is 9.3 (Critical) , with a network attack vector, low complexity, ...
CVE-2026-81293 WordPress WP Data Access plugin <= 5.5.81 - SQL Injection vulnerability
Unauthenticated SQL Injection in WP Data Access = 5.5.81 versions...
USN-8694-1: CRaC JDK 21 vulnerabilities
It was discovered that the JSSE component of CRaC JDK 21 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. CVE-2026-46968 It was discovered that the JSSE component of CRaC JDK 21 did not correctly authorize users. A remote...
USN-8689-1 openjdk-26 vulnerabilities
It was discovered that the JSSE component of OpenJDK 26 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. CVE-2026-46968 It was discovered that the JSSE component of OpenJDK 26 did not correctly authorize users. A remote attack...
The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge web browsers allows attackers to access confidential data.
The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge relates to reading data beyond the allowed buffer size. Exploiting this vulnerability can allow an attacker to access confidential data through a specially created HTML page...
EUVD-2026-67934
When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. In deployments that rely on client certificates as the sole means of...
EUVD-2026-67953
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary flows and access sensitive information due to improper authentication...
CVE-2026-18891
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary flows and access sensitive information due to improper authentication...
CVE-2026-82287
Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue credentialed cross-origin requests from any website t...
CVE-2026-82287
Rybbit before 2.7.0 contains a CORS misconfiguration in its server that reflects any request origin in the Access-Control-Allow-Origin response header while credentials remain enabled. This allows an attacker on any website to issue credentialed cross-origin requests against a victim's session, r...
