950 matches found
CVE-2026-14552
GitLab CE/EE is vulnerable to an incorrect authorization issue (CWE-863) affecting versions 17.0 before 19.2.8 , 19.3 before 19.3.5 , and 19.4 before 19.4.2 . Under specific conditions, an authenticated user with Guest access could read confidential epic content that was intended to be restricted...
CVE-2025-66954
CVE-2025-66954 – Buffalo LinkStation Username Enumeration via IDOR Summary A vulnerability in Buffalo LinkStation firmware version 1.85-0.01 allows unauthenticated or guest-level users to enumerate valid usernames and their associated privilege roles. The issue arises due to improper access contr...
CVE-2026-4480-PoC
CVE-2026-4480-PoC CVE-2026-4480 – Inyección de Comandos en el Nombre del Trabajo de Impresión de Samba Resumen CVE-2026-4480 es una vulnerabilidad de inyección de comandos que afecta a ciertas configuraciones de impresión de Samba que utilizan comandos de impresión externos. La vulnerabilidad...
osTicket - Arbitrary File Read
Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an arbitrary file read vulnerability in the ticket PDF export functionality. A remote attacker can submit a ticket containing crafted rich-text HTML that includes PHP filter expressions which are insufficientl...
Astra Linux – Vulnerability in Qemu
A vulnerability related to out-of-bounds read/write access was discovered in the USB emulator of QEMU in versions prior to 5.2.0. This issue occurs during the processing of USB packets from a guest, when the value of USBDevice’s ‘setuplen’ exceeds the value of ‘databuf4096’ in the dotokenin and...
CVE-2026-89957 s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed
In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed The vfioapmdevhotunplugcfg function uses the return value of bitmapandnot to determine whether the guest APCB needs to be updated. However, bitmapandnot...
CVE-2026-92802: Missing Authorization
kan through 0.6.0 fails to properly validate board creation permissions in the GitHub project import endpoint, allowing guests to create boards despite lacking board:create permission. Attackers can bypass authorization checks by using the importProjects mutation to create boards while remaining...
EUVD-2026-79295
Joomla Extension - j2commerce.com - Predictable/forgeable order access token in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Anyone who obtains the site's Joomla secret can compute a valid access token for any order on the site without ever having placed one, gaining guest access to that...
CVE-2026-82190
J2Store (a Joomla e-commerce extension by j2commerce.com) contains a predictable/forgeable order access token vulnerability affecting versions 1.0.0–3.3.2, 4.0.0–4.0.22, and 4.1.0–4.1.7 . Anyone who obtains the site's Joomla secret can compute a valid access token for any order without having pla...
CVE-2026-82190 Joomla Extension - j2commerce.com - Predictable/forgeable order access token in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7
Joomla Extension - j2commerce.com - Predictable/forgeable order access token in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Anyone who obtains the site's Joomla secret can compute a valid access token for any order on the site without ever having placed one, gaining guest access to that...
CVE-2026-82190 Joomla Extension - j2commerce.com - Predictable/forgeable order access token in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7
Joomla Extension - j2commerce.com - Predictable/forgeable order access token in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Anyone who obtains the site's Joomla secret can compute a valid access token for any order on the site without ever having placed one, gaining guest access to that...
CVE-2026-82190: Use of Predictable Algorithm in Random Number Generator
Joomla Extension - j2commerce.com - Predictable/forgeable order access token in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Anyone who obtains the site's Joomla secret can compute a valid access token for any order on the site without ever having placed one, gaining guest access to that...
PT-2026-92397
Joomla Extension - j2commerce.com - Predictable/forgeable order access token in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Anyone who obtains the site's Joomla secret can compute a valid access token for any order on the site without ever having placed one, gaining guest access to that...
Astra Linux – Vulnerability in libvirt
A flaw was discovered in libvirt during its generation of SELinux MCS category pairs for virtual machines’ dynamic labels. This flaw allows one exploited guest to access files labeled for another guest, resulting in the breach of sVirt confinement. The greatest threat posed by this vulnerability...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: The entire AP matrix is always filtered. The vfioapmdevfiltermatrix function is called whenever a new adapter or domain is assigned to the mdev. The purpose of this function is to update the guest’s AP configuration...
CVE-2026-88269
GeoVision GV-LPC2211 V1.13 allows a Guest user to retrieve persistent device configuration containing plaintext administrative and user credentials through SSVR...
CVE-2026-88270
GeoVision GV-LPC2211 (and GV-LPC2011, per the title) V1.13 is affected by a Denial of Service vulnerability in the SSVR (Secure Service Virtual Router) component. A user with Guest privileges can trigger the firmware-upgrade mode and cause live services to be disrupted before any firmware image i...
EUVD-2026-75302
GeoVision GV-LPC2211 V1.13 allows a Guest user to retrieve persistent device configuration containing plaintext administrative and user credentials through SSVR...
CVE-2026-88269 GV-LPC2011/LPC2211 - SSVR Guest Configuration and Credential Disclosure
GeoVision GV-LPC2211 V1.13 allows a Guest user to retrieve persistent device configuration containing plaintext administrative and user credentials through SSVR...