10701 matches found
CVE-2026-90969
Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking the view-password permission to obtain cleartext passwords via a request to the entry listing endpoint with password disclosure parameters...
EUVD-2026-79185
Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking the view-password permission to obtain cleartext passwords via a request to the entry listing endpoint with password disclosure parameters...
CVE-2026-90969
Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking the view-password permission to obtain cleartext passwords via a request to the entry listing endpoint with password disclosure parameters...
CVE-2026-90969
An improper access control vulnerability exists in the vault entry listing feature of Devolutions Server 2026.2.16 and earlier versions. This flaw allows an authenticated user who lacks the specific view-password permission to obtain cleartext passwords . The vulnerability is triggered by sending...
CVE-2026-68534 Concrete CMS below 9.5.2 is vulnerable to Stored XSS via unescaped Express entry labels in association selectors
Concrete CMS before 9.5.3 rendered Express entry labels as raw HTML when displaying associated entries, resulting in stored cross-site scripting. An unauthenticated attacker could submit a payload through a public Express Form; it then executed in an administrator's dashboard session when the...
EUVD-2026-79143
Concrete CMS before 9.5.3 rendered Express entry labels as raw HTML when displaying associated entries, resulting in stored cross-site scripting. An unauthenticated attacker could submit a payload through a public Express Form; it then executed in an administrator's dashboard session when the...
CVE-2026-68534 Concrete CMS below 9.5.2 is vulnerable to Stored XSS via unescaped Express entry labels in association selectors
Concrete CMS before 9.5.3 rendered Express entry labels as raw HTML when displaying associated entries, resulting in stored cross-site scripting. An unauthenticated attacker could submit a payload through a public Express Form; it then executed in an administrator's dashboard session when the...
CVE-2026-68534
Concrete CMS before 9.5.3 contained a stored cross-site scripting (XSS) vulnerability caused by Express entry labels being rendered as raw HTML in association selectors. An unauthenticated attacker could submit a malicious payload through a public Express Form, which would then execute in an admi...
CVE-2026-21587
creationtimestamp| type| source ---|---|--- 2026-09-15 17:17:55+00:00| seen| https://bsky.app/profile/suriq.io/post/3mvl4xmx3vb2g...
CVE-2026-78225
creationtimestamp| type| source ---|---|--- 2026-09-15 16:15:50+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-02 2026-09-16 04:07:56+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvmbbxn7xj24 2026-09-16 08:10:04+00:00| seen|...
CVE-2026-84534
creationtimestamp| type| source ---|---|--- 2026-09-15 04:49:55+00:00| seen| https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities20260915 2026-09-15 20:50:29+00:00| seen| https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-apple-19 2026-09-16 22:01:06+00:00|...
CVE-2026-43785
creationtimestamp| type| source ---|---|--- 2026-09-15 04:46:21+00:00| seen| https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities20260915 2026-09-15 20:48:03+00:00| seen| https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-apple-19 2026-09-16 22:01:29+00:00|...
EUVD-2026-78209
DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can stream tar entries with traversal sequences to write arbitrary files on the developer workstation, enabling code execution...
EUVD-2026-78213
A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. User interaction an AclAgent restart by an...
CVE-2026-90969: Improper Access Control
Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking the view-password permission to obtain cleartext passwords via a request to the entry listing endpoint with password disclosure parameters...
PT-2026-92410
Name of the Vulnerable Software and Affected Versions Devolutions Server versions prior to 2026.2.17 Description Improper access control in the vault entry listing feature allows an authenticated user who does not have the view-password permission to obtain cleartext passwords. This is achieved b...
PT-2026-92376
Concrete CMS before 9.5.3 rendered Express entry labels as raw HTML when displaying associated entries, resulting in stored cross-site scripting. An unauthenticated attacker could submit a payload through a public Express Form; it then executed in an administrator's dashboard session when the...
CVE-2026-68534: Improper Neutralization of Input During Web Page Generation
Concrete CMS before 9.5.3 rendered Express entry labels as raw HTML when displaying associated entries, resulting in stored cross-site scripting. An unauthenticated attacker could submit a payload through a public Express Form; it then executed in an administrator's dashboard session when the...
CVE-2026-91200
DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can stream tar entries with traversal sequences to write arbitrary files on the developer workstation, enabling code execution...
CVE-2026-75944
A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. User interaction an AclAgent restart by an...