67637 matches found
CVE-2026-76176: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the endpoint /ocsreports/index.php?function=admindouble due to improper processing of the values in the ID field included in the selectedgrpdupli parameter. An authenticated user with operator privileges can manipulate these values to alter the SQL queries executed ...
PT-2026-84984
A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is the function sess nowait of the file s71.py of the component Session Management. This manipulation of the argument session id causes authorization bypass. The attack can be initiated remotely. The vendor was...
PT-2026-85308
Name of the Vulnerable Software and Affected Versions Microsoft Entra ID affected versions not specified Description An authentication bypass exists that allows an unauthorized attacker to elevate privileges over a network by using an alternate path or channel. Recommendations At the moment, ther...
CVE-2026-62916: Authentication Bypass Using an Alternate Path or Channel
Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-65109
Fix slurmstepd removing files outside the container spool directory when cleaning up an OCI containe, Fix slurmstepd leaving OCI container spool directories behind when ContainerPath contains a task id pattern...
KLA91257 Multiple vulnerabilities in Microsoft Azure
Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to bypass security restrictions, gain privileges, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. An information disclosure vulnerability i...
CVE-2026-85392: Authorization Bypass Through User-Controlled Key
Peppermint through 0.5.5 contains an authorization bypass vulnerability in the GET /api/v1/auth/user/:id/logout endpoint that allows authenticated attackers to delete sessions for any user by supplying arbitrary user IDs. Attackers can forcibly log out any user including administrators by calling...
GO-2026-6305 Pocket-ID has an Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=none in github.com/pocket-id/pocket-id/backend
Pocket-ID has an Open Redirect on the OIDC /authorize page via unvalidated redirecturi with prompt=none in github.com/pocket-id/pocket-id/backend. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this ...
MINI-PH78-F754-W947
Bulletin has no description...
MINI-R2FX-2JR5-5J94
Bulletin has no description...
CVE-2026-84672
Jenkins Microsoft Entra ID previously Azure AD Plugin 710.v0bff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID and its display name, allowing attackers who can create an Entra group with a colliding display name to gain the permissions configured for a...
MINI-F428-6X6M-XFWV
Bulletin has no description...
CVE-2026-84672
Jenkins Microsoft Entra ID previously Azure AD Plugin 710.v0bff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID and its display name, allowing attackers who can create an Entra group with a colliding display name to gain the permissions configured for a...
CVE-2026-84672
The Jenkins Microsoft Entra ID (previously Azure AD) Plugin versions 710.v0b_ff8e9cc2d2 and earlier are vulnerable to a privilege escalation flaw. The plugin grants permissions based on both the Entra group's unique object ID and its display name . Since display names are not globally unique, an ...
EUVD-2026-70145
Jenkins Microsoft Entra ID previously Azure AD Plugin 710.v0bff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID and its display name, allowing attackers who can create an Entra group with a colliding display name to gain the permissions configured for a...
CVE-2026-84672
Jenkins Microsoft Entra ID previously Azure AD Plugin 710.v0bff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID and its display name, allowing attackers who can create an Entra group with a colliding display name to gain the permissions configured for a...
Improper Input Validation
Engine.IO is vulnerable to Improper Input Validation. The vulnerability is due to improper validation of the WebTransport session ID, which allows an unauthenticated remote attacker to trigger a TypeError and crash the Node.js server process, causing denial of service...
MINI-GV9G-85W8-RF6Q
Bulletin has no description...