67479 matches found
CVE-2026-73669
The Signify Philips Hue Bridge Pro firmware embeds a Mosquitto MQTT broker service that listens on all network interfaces without authentication. An unauthenticated attacker with network access to the MQTT service on a vulnerable system can read data and control connected lights. Fixed in...
EUVD-2026-58240
The Signify Philips Hue Bridge Pro firmware embeds a Mosquitto MQTT broker v2.0.22 that listens on all network interfaces with anonymous access enabled and no firewall restriction. An attacker with access to the Bridge's network can read device data and control connected lights...
CVE-2026-73669 Signify Philips Hue Bridge Pro MQTT broker missing authentication
The Signify Philips Hue Bridge Pro firmware embeds a Mosquitto MQTT broker service that listens on all network interfaces without authentication. An unauthenticated attacker with network access to the MQTT service on a vulnerable system can read data and control connected lights. Fixed in...
CVE-2024-58374
CVE-2024-58374 involves an unauthenticated SQL injection in the getSdutyTree servlet of Hongjing e-HR. The vulnerability allows remote attackers to bypass the oauthservlet authentication filter by using a path traversal sequence in the request URI and to inject UNION-based SQL payloads through th...
CVE-2026-58432
Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea...
CVE-2026-58434
Private Repository Metadata Remains Accessible After Access Revocation...
CVE-2026-58417
REST API exposes organization membership of private organizations to public...
.NET: .NET Information Disclosure Vulnerability
Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network...
CVE-2026-58511
CVE-2026-58511 describes a vulnerability in Gitea where the webhook Authorization header is returned in plaintext via the API. The root cause is described in connected sources as deficiencies in access control, enabling an attacker with sufficient privileges to potentially access or infer header ...
CVE-2026-58511 Webhook Authorization Header Returned in Plaintext via API
Webhook Authorization Header Returned in Plaintext via API...
CVE-2026-58434
CVE-2026-58434 affects Gitea: Private Repository Metadata Remains Accessible After Access Revocation. Demonstrated in public advisories with a PoC reference (GHSA-j2w3-9c3r-g83q) and linked to the Gitea 1.27.0 release. Affected software is Gitea (go-gitea) and related deployments prior to the fix...
CVE-2026-58432
CVE-2026-58432 relates to Gitea (code.gitea.io/gitea) and describes missing authorization and an authorization bypass via a user-controlled key, plus incorrect permissions on a critical resource that could expose sensitive information to an unauthorized actor. The CVE is rated with CVSS v3.1 base...
CVE-2026-58432 Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea
Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea...
CVE-2026-58432 Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea
Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea...
CVE-2026-58417 REST API exposes organization membership of private organizations to public
REST API exposes organization membership of private organizations to public...
CVE-2026-58417
The CVE-2026-58417 issue affects Gitea: the REST API endpoint /orgs/{org}/public_members/{username} leaks organization membership of private orgs to public. According to the sources, an authenticated user can probe membership of a user in a private org and receive a response (PoC shows HTTP 204) ...
CVE-2026-57886
CVE-2026-57886 affects Gitea (Go) and is described as a cross-repository issue where re-linking of attachments for issues/comments can expose private attachment content. The CVE notes a high confidentiality impact (C) with network attack vector, high exploitability due to low privileges and no us...
CVE-2026-68453
A flaw was found in the Linux kernel's s390/zcrypt component. This vulnerability arises from insufficient validation of user-controlled length fields within the Common Cryptographic Architecture CCA token structures. An attacker could manipulate these fields to cause a buffer over-read or...