8666 matches found
CVE-2026-63498: Improper Neutralization of Input During Web Page Generation
Snipe-IT is an IT asset/license management system. Prior to 8.7.0, the uploaded-files API endpoint GET /api/v1/objecttype/id/files/fileid allows an authenticated user with file-management access to upload XML and XSLT attachments and request them with the inline=true parameter. The...
CVE-2026-63493: Authentication Bypass Using an Alternate Path or Channel
Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a password-authenticated session for an account with self.api permission can reach the personal-access-token API flow before completing the account's second-factor challenge because CheckForTwoFactor is enforced in the web...
CVE-2026-62368: Improper Neutralization of Input During Web Page Generation
Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in CustomField.name, and app/Presenters/AssetPresenter.php assigns that value as an unescaped bootstrap-table header title. When another user opens an asset-list page...
CLSA-2026-1790161417 TuxCare security update for markdown-it (1 CVE)
TuxCare rebuilt markdown-it to address 1 CVE. Fixed in 4.4.0-tuxcare.2...
PT-2026-105381
TuxCare rebuilt markdown-it to address 1 CVE. Fixed in 4.4.0-tuxcare.2...
ROOT-APP-NPM-AIKIDO-2026-549894 AIKIDO-2026-549894 in markdown-it - Patched by Root
Root has patched AIKIDO-2026-549894 in the markdown-it package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2022-21670 CVE-2022-21670 in markdown-it - Patched by Root
Root has patched CVE-2022-21670 in the markdown-it package for Root:npm. Multiple fixed versions available...
PT-2026-105937
Root has patched AIKIDO-2026-549894 in the markdown-it package for Root:npm. Multiple fixed versions available...
WordPress wpShopGermany IT-RECHT KANZLEI plugin 1.6-2.3 - Unauthenticated RCE vulnerability
Unauthenticated RCE vulnerability discovered by Naoki Kawahigashi in WordPress Plugin wpShopGermany IT-RECHT KANZLEI versions 1.6-2.3...
CVE-2026-88795
The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely, deriving it from data the requester controls and creating it as a side effect of the check that is supposed to validate it, allowing unauthenticated attackers to predict the tok...
CVE-2026-88795 wpShopGermany IT-RECHT KANZLEI < 2.4 - Unauthenticated RCE via Predictable API Token
The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely, deriving it from data the requester controls and creating it as a side effect of the check that is supposed to validate it, allowing unauthenticated attackers to predict the tok...
CVE-2026-88795
The wpShopGermany IT-RECHT KANZLEI WordPress plugin (versions before 2.4 ) contains a vulnerability where it fails to generate API authentication tokens securely. The plugin derives these tokens from data controlled by the requester and creates them as a side effect of the validation check. This ...
EUVD-2026-81347
The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely, deriving it from data the requester controls and creating it as a side effect of the check that is supposed to validate it, allowing unauthenticated attackers to predict the tok...
CVE-2026-88795 wpShopGermany IT-RECHT KANZLEI < 2.4 - Unauthenticated RCE via Predictable API Token
The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely, deriving it from data the requester controls and creating it as a side effect of the check that is supposed to validate it, allowing unauthenticated attackers to predict the tok...
PT-2026-94171
Name of the Vulnerable Software and Affected Versions wpShopGermany IT-RECHT KANZLEI versions prior to 2.4 Description The plugin fails to generate API authentication tokens securely. The token is derived from data controlled by the requester and is created as a side effect of the validation chec...
CVE-2026-88795: Improper Control of Generation of Code
The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely, deriving it from data the requester controls and creating it as a side effect of the check that is supposed to validate it, allowing unauthenticated attackers to predict the tok...
Security Bulletin: Multiple Vulnerabilities in watsonx.data
Summary Multiple vulnerabilities were addressed in watsonx.data 2.4.0 patch 5 version, which was present in different version from watson.data 2.4.0 Vulnerability Details CVEID:CVE-2026-41115 DESCRIPTION: An improper authorization vulnerability has been identified in Apache Kafka. The...
Cybersecurity in Power Grids: Standards and Research Challenges
This paper examines Smart Grid cybersecurity, emphasizing the critical distinctions between IT and OT environments. It analyzes grid architecture, substation threats, and key international standards, specifically IEC 62351, IEC 62443, and ISO 27001. Finally, it overviews latest research trends,...