Lucene search
+L

93909 matches found

NVD
NVD
added 2026/08/11 6:18 p.m.16 views

CVE-2026-69102

MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in application-maxkey.properties that allows unauthenticated attackers to forge valid JWT tokens and authenticate as any user by exploiting the password-skipped login endpoint. Attackers can craft a JWT...

9.8CVSS0.00442EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/08/11 6:04 p.m.28 views

CVE-2026-69102 MaxKey Hard-coded JWT Secret Unauthorized Access via /login/jwt/trust

MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in application-maxkey.properties that allows unauthenticated attackers to forge valid JWT tokens and authenticate as any user by exploiting the password-skipped login endpoint. Attackers can craft a JWT...

9.8CVSS0.00442EPSS
SaveExploits0References4
OSV
OSV
added 2026/08/11 6:04 p.m.5 views

CVE-2026-69102 MaxKey Hard-coded JWT Secret Unauthorized Access via /login/jwt/trust

MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in application-maxkey.properties that allows unauthenticated attackers to forge valid JWT tokens and authenticate as any user by exploiting the password-skipped login endpoint. Attackers can craft a JWT...

9.3CVSS5.4AI score
SaveExploits0References6
RedHat Linux
RedHat Linux
added 2026/08/11 5:41 p.m.7 views

picketlink-federation: auth bypass in Picketlink SAML unsolicited-response

A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted...

9.8CVSS5.3AI score0.00299EPSS
SaveExploits0References4
RedHat Linux
RedHat Linux
added 2026/08/11 5:41 p.m.10 views

undertow-core: Undertow: Authentication Bypass via AJP ssl_cert/is_ssl Forgery

the Undertow AJP listener honours forged sslcert and isssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP...

7.4CVSS5.3AI score0.00222EPSS
SaveExploits0References4
NVD
NVD
added 2026/08/11 5:19 p.m.27 views

CVE-2026-69223

Apache Allura's webhooks are vulnerable to Server-Side Request Forgery SSRF. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...

9.1CVSS0.00728EPSS
SaveExploits0References3
NVD
NVD
added 2026/08/11 5:18 p.m.7 views

CVE-2026-48483

TypeBot is a chatbot builder tool. Prior to version 3.17.0, Typebot's WhatsApp status forwarding feature stores a workspace-configured webhook forwarding URL and later POSTs WhatsApp marketing/error status events to it from the server. The stored URL is only validated as a generic URL in settings...

5.4CVSS0.00331EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/08/11 5:05 p.m.7 views

EUVD-2026-56447

Server-side request forgery ssrf in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network...

6.5CVSS5.2AI score0.0065EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/11 5:04 p.m.38 views

CVE-2026-65660 Microsoft SharePoint Server Spoofing Vulnerability

...

6.5CVSS0.00742EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/11 5:03 p.m.6 views

EUVD-2026-56286

Apache Allura's webhooks are vulnerable to Server-Side Request Forgery SSRF. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...

5.2AI score0.00728EPSS
SaveExploits0References2
IBM Security Bulletins
IBM Security Bulletins
added 2026/08/11 5:01 p.m.13 views

Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a server-side request forgery (CVE-2026-14529)

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a server-side request forgery vulnerability when sipServlet-1.1 is enabled. Vulnerability Details CVEID:CVE-2026-14529 DESCRIPTION: IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere...

9.8CVSS5.3AI score0.00395EPSS
SaveExploits0Affected Software1
EUVD
EUVD
added 2026/08/11 5:00 p.m.9 views

EUVD-2026-56282

CAI Content Credentials is affected by a Server-Side Request Forgery SSRF vulnerability that could result in privilege escalation. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed...

4.7CVSS5.3AI score0.00441EPSS
SaveExploits0References1
RedHat Linux
RedHat Linux
added 2026/08/11 4:39 p.m.11 views

undertow-core: Undertow: Authentication Bypass via AJP ssl_cert/is_ssl Forgery

the Undertow AJP listener honours forged sslcert and isssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP...

7.4CVSS5.4AI score0.00222EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/08/11 4:21 p.m.35 views

CVE-2026-48483 TypeBot's WhatsApp status forwarding uses unvalidated user-controlled URLs, allowing SSRF from the Typebot server

TypeBot is a chatbot builder tool. Prior to version 3.17.0, Typebot's WhatsApp status forwarding feature stores a workspace-configured webhook forwarding URL and later POSTs WhatsApp marketing/error status events to it from the server. The stored URL is only validated as a generic URL in settings...

5.4CVSS0.00331EPSS
SaveExploits0References4
OSV
OSV
added 2026/08/11 4:17 p.m.7 views

DEBIAN-CVE-2026-6726

An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key such as an Attestation Key, DevID Key or TLS authentication key and falsify other TPM 2...

7.9CVSS5.5AI score0.00215EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/11 4:17 p.m.10 views

CVE-2026-6727

A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with access to the TPM command interface may be able to exploit timing differences to recover information that could allow decryption of ciphertexts encrypted to TPM-managed RSA keys,...

5.9CVSS0.00203EPSS
SaveExploits0References3
NVD
NVD
added 2026/08/11 4:17 p.m.12 views

CVE-2026-6726

An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key such as an Attestation Key, DevID Key or TLS authentication key and falsify other TPM 2...

7.9CVSS0.00215EPSS
SaveExploits0References3
OSV
OSV
added 2026/08/11 4:17 p.m.4 views

UBUNTU-CVE-2026-6727

A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with access to the TPM command interface may be able to exploit timing differences to recover information that could allow decryption of ciphertexts encrypted to TPM-managed RSA keys,...

5.9CVSS5.3AI score0.00203EPSS
SaveExploits0References6
OSV
OSV
added 2026/08/11 4:17 p.m.7 views

UBUNTU-CVE-2026-6726

An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key such as an Attestation Key, DevID Key or TLS authentication key and falsify other TPM 2...

7.9CVSS5.5AI score0.00215EPSS
SaveExploits0References6
UbuntuCve
UbuntuCve
added 2026/08/11 4:17 p.m.11 views

CVE-2026-6727

A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with access to the TPM command interface may be able to exploit timing differences to recover information that could allow decryption of ciphertexts encrypted to TPM-managed RSA keys,...

5.9CVSS5.3AI score0.00203EPSS
SaveExploits0References5
Rows per page
Query Builder