24134 matches found
CVE-2026-16504
Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password "zulip", and DISABLEHTTPS=True...
CVE-2026-16504
The VPS.org one-click Zulip template contains multiple vulnerabilities due to the use of static templates without per-deployment randomization. Specifically, the template deploys with a hardcoded application signing key (secret_key: changeme ), a default database password (zulip ), and the config...
CVE-2026-16504 VPS.org one-click Zulip template deployment instance contains multiple vulnerabilities
Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password "zulip", and DISABLEHTTPS=True...
CVE-2026-16504 VPS.org one-click Zulip template deployment instance contains multiple vulnerabilities
Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password "zulip", and DISABLEHTTPS=True...
EUVD-2026-51548
Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password "zulip", and DISABLEHTTPS=True...
CVE-2026-16503 VPS.org one-click Supabase template deployment instance contains multiple vulnerabilities
Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces 0.0.0.0:5432 with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration...
CVE-2026-16503
The VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces (0.0.0.0:5432 ) using the default password "postgres" . Because Docker manages its own iptables rules, this configuration bypasses standard host UFW firewall protections. A remote attacker ca...
EUVD-2026-51547
Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces 0.0.0.0:5432 with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration...
CVE-2026-16503 VPS.org one-click Supabase template deployment instance contains multiple vulnerabilities
Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces 0.0.0.0:5432 with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration...
CVE-2026-10079
A flaw was found in Red Hat Advanced Cluster Security for Kubernetes RHACS. When processing Kubernetes Deployments, ACS replaces deployment identity metadata based on the openshift.io/encoded-deployment-config label. A user with permission to create Deployments can set this label to "null", causi...
CVE-2026-10079 Stackrox: stackrox: deploy-time policy enforcement and visibility bypass via label injection
A flaw was found in Red Hat Advanced Cluster Security for Kubernetes RHACS. When processing Kubernetes Deployments, ACS replaces deployment identity metadata based on the openshift.io/encoded-deployment-config label. A user with permission to create Deployments can set this label to "null", causi...
CVE-2026-65310
ANDRITZ HIPASE-250 formerly 250 SCALA, in the default configuration of affected versions, exposes its data and configuration endpoint without any authentication and permissive CORS on every response. An unauthenticated attacker with network access can read live process values and server...
EUVD-2026-51500
ANDRITZ HIPASE-250 formerly 250 SCALA, in the default configuration of affected versions, exposes its data and configuration endpoint without any authentication and permissive CORS on every response. An unauthenticated attacker with network access can read live process values and server...
CVE-2026-65310 Missing authentication and permissive CORS policy
ANDRITZ HIPASE-250 formerly 250 SCALA, in the default configuration of affected versions, exposes its data and configuration endpoint without any authentication and permissive CORS on every response. An unauthenticated attacker with network access can read live process values and server...
CVE-2026-65310
CVE-2026-65310 affects ANDRITZ HIPASE-250 (formerly 250 SCALA). In default configurations, the product exposes its data and configuration endpoint without authentication and with permissive CORS on every response. An unauthenticated attacker with network access can read live process values and se...
CVE-2026-12251
The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities from the roles it makes selectable on its registration forms, and its post-registration safeguard against elevated accounts is disabled by default, allowing unauthenticated users to register with a...
CVE-2026-6890
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
EUVD-2026-51379
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2026-6890
This CVE-2026-6890 entry, as reflected by PT-2026-66670, concerns a default-credentials vulnerability in Advantech ECU-1251D. A remote attacker could gain unauthorised SSH access via the device’s default root account with no password, because credentials are not changed during configuration. The ...