1180 matches found
CVE-2024-27928 Vantage6: 2FA can be circumvented with hacked email access
vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to version 5.0.0, if an attacker hacks into a vantage6 user's email account, they can 1 reset the password via email and then 2 reset the 2FA token via email. This way they reduce 2FA to 1FA email access. Note that...
CVE-2024-27928 Vantage6: 2FA can be circumvented with hacked email access
vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to version 5.0.0, if an attacker hacks into a vantage6 user's email account, they can 1 reset the password via email and then 2 reset the 2FA token via email. This way they reduce 2FA to 1FA email access. Note that...
CVE-2026-12151
Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size...
CVE-2026-49780
Customer Privilege Escalation in Dokan = 5.0.2 versions...
EUVD-2026-36903
Subscriber SQL Injection in Taskbuilder = 5.0.7 versions...
EUVD-2026-36897
Customer Privilege Escalation in Dokan = 5.0.2 versions...
PT-2026-49516
Name of the Vulnerable Software and Affected Versions Dokan versions prior to 5.0.3 Description A privilege escalation issue exists that allows a user with customer privileges to gain higher access levels. Recommendations Update to a version later than 5.0.2...
PT-2026-49521
Subscriber SQL Injection in Taskbuilder = 5.0.7 versions...
Photon OS 5.0: Go PHSA-2026-5.0-0869
An update of the go package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-0869. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid320798...
CVE-2026-20260
In Splunk SOAR Security Orchestration, Automation, and Response versions below 8.5.0, an unauthenticated attacker could inject American National Standards Institute ANSI escape codes into SOAR application log files through specially crafted HTTP request paths, which a terminal emulator might...
WordPress Taskbuilder plugin <= 5.0.7 - SQL Injection vulnerability
SQL Injection vulnerability discovered by VanTastic in WordPress Plugin Taskbuilder versions = 5.0.7...
CVE-2026-46543 nimiq-blockchain: Genesis batch set request
Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.5.0, a remote peer can crash any full node by sending a RequestBatchSet message containing the genesis block's hash. The handler calls getepochchunks which iterates...
CVE-2026-39169
SEMCMS 5.0 is vulnerable to unauthorized access in SEMCMScopy.php...
CVE-2026-39170
SemCms 5.0 is vulnerable to Cross Site Request Forgery CSRF via crafted POST request to /admin/semcmsuser.php...
CVE-2026-39170
CVE-2026-39170 affects SemCms 5.0 and is described as a Cross Site Request Forgery (CSRF) vulnerability triggered by a crafted POST request to /admin/semcms_user.php. The connected documents provide the affected product and the vulnerability class but do not include detailed exploit steps, affect...
CVE-2026-39170
SemCms 5.0 is vulnerable to Cross Site Request Forgery CSRF via crafted POST request to /admin/semcmsuser.php...
EUVD-2026-21581
GeoNode contains a server-side request forgery vulnerability in the service registration endpoint...
CVE-2026-41661
Admidio is an open-source user management solution. Prior to version 5.0.9, an unauthenticated attacker can execute arbitrary JavaScript in any Admidio user's browser through a reflected XSS in system/msgwindow.php. The endpoint passes user input through htmlspecialchars, which does not encode...
EUVD-2026-34904
OpenXDMoD is an open framework for collecting and analyzing HPC metrics. Starting in version 9.5.0 and prior to version 11.0.3, an attacker can remotely execute arbitrary system commands on the web server hosting Open XDMoD with the privileges of the web server process. This could allow an attack...