20637 matches found
CVE-2026-58415
Internal state files accessible to external parties in moddavfs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory This issue affects...
djust has broken object-level access control (IDOR)
Impactdjust's per-object authorization getobject + hasobjectpermission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry points: a the initial HTTP GET render, b SPA urlchange navigation, and c % liverender % embedded child views. An authenticated us...
PYSEC-2026-4041 djust has broken object-level access control (IDOR)
Impact djust's per-object authorization getobject + hasobjectpermission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry points: a the initial HTTP GET render, b SPA urlchange navigation, and c % liverender % embedded child views. An authenticated...
tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass
A flaw was found in Apache Tomcat. This incorrect authorization vulnerability occurs within the FORM authentication process, allowing a user to bypass security constraints. This bypass enables unauthorized access to resources via a GET request, even when those resources are intended to be...
CVE-2026-58415 Apache HTTP Server: mod_dav_fs property database read access
Internal state files accessible to external parties in moddavfs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory This issue affects...
EUVD-2026-90897
Internal state files accessible to external parties in moddavfs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory This issue affects...
CVE-2026-58415
The Apache HTTP Server is vulnerable to an information disclosure flaw in the mod_dav_fs module (versions 2.4.0 through 2.4.68 ) on all platforms. A remote attacker can perform a GET request directly to the internal .DAV state directory to read internal state files. This allows unauthorized acces...
CVE-2026-58415
Internal state files accessible to external parties in moddavfs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory This issue affects...
CVE-2026-58415 Apache HTTP Server: mod_dav_fs property database read access
Internal state files accessible to external parties in moddavfs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory This issue affects...
CVE-2024-3273-EXPLOIT
CVE-2024-3273 - D-Link Remote Code Execution RCE đĨ A critical vulnerability, classified as CVE-2024-3273, was discovered in several D-Link NAS devices, including DNS-320L, DNS-325, DNS-327L, and DNS-340L, up to the date of 20240403. This vulnerability affects an unknown function of the file...
CVE-2026-34189
Cross-Site Request Forgery CSRF vulnerability allows unauthorized deletion of event responses via a forged GET request when an authenticated administrator visits a malicious page. This issue affects Pandora FMS: from 777 onwards...
BIT-RABBITMQ-2026-61837 RabbitMQ: AMQP 1.0 management `GET /bindings` exposes full binding topology to any authenticated AMQP user without resource/management permission checks
RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, AMQP 1.0 management GET /bindings exposes full binding topology to any authenticated AMQP user without resource/management permission checks. the AMQP 1.0 HTTP-over-AMQP management endpoint GET...
EUVD-2026-90592
Cross-Site Request Forgery CSRF vulnerability allows unauthorized deletion of alert commands via sequential, unvalidated GET requests when an authenticated administrator visits a malicious page. This issue affects Pandora FMS: from 777 onwards...
CVE-2026-34189 CSRF in Event Response Deletion
Cross-Site Request Forgery CSRF vulnerability allows unauthorized deletion of event responses via a forged GET request when an authenticated administrator visits a malicious page. This issue affects Pandora FMS: from 777 onwards...
CVE-2026-34189
A Cross-Site Request Forgery (CSRF) vulnerability exists in Pandora FMS (version 777 onwards). This flaw allows an attacker to trigger the unauthorized deletion of event responses by tricking an authenticated administrator into visiting a malicious page, which then executes a forged GET request ....
EUVD-2026-90591
Cross-Site Request Forgery CSRF vulnerability allows unauthorized deletion of event responses via a forged GET request when an authenticated administrator visits a malicious page. This issue affects Pandora FMS: from 777 onwards...
EUVD-2025-209818
The Broadstreet plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.53.1 via the getsponsoredmeta AJAX action. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract data from password protect...
PT-2026-104045
infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via /v1/document/get/...
AlmaLinux 9.2 [TuxCare] Security Update: cups-filters / cups-filters-devel / cups-filters-libs (ALMALINUX9.2:CLSA-2025:1744716861)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1744716861 advisory. - CUPS is a standards-based, open-source printing system, and cups-browsed contains network printing functionality including, but not limited...