CVE-2026-33465: Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user with low-level permissions could submit a specially crafted request that causes excessive resource consumption, which may render Kibana...

PT-2026-84147

Name of the Vulnerable Software and Affected Versions Dell PowerStore affected versions not specified Description An incorrect authorization issue allows an authenticated attacker with low privileges to invoke operations reserved for administrators, resulting in privilege escalation...

PT-2026-84448

A denial-of-service vulnerability exists in the web-based management interface of HPE Networking Fabric Composer that could allow an authenticated low privilege operator user to cause a denial of service. Successful exploitation could allow an attacker to disrupt the availability of the affected...

PT-2026-84476

Name of the Vulnerable Software and Affected Versions AOS-CX affected versions not specified Description A privilege escalation issue exists in the API endpoint of AOS-CX. This allows an authenticated user with low privilege operator permissions to modify the state of specific system settings...

Linux Distros Unpatched Vulnerability : CVE-2026-84125

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2...

CVE-2026-73723: Incorrect Authorization

A privilege escalation vulnerability exists in the web-based management interface of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to complete state-changing actions that should not be allowed by their current level of authorizati...

CVE-2026-77352

Wallos (open-source, self-hostable personal subscription tracker) versions 2.0.0 through before 5.0.0 contain an authenticated SSRF via the per-user SMTP notification host. Any authenticated user (no admin rights required) can set their notification SMTP host to an internal or link-local address....

CVE-2026-77352 Wallos: Authenticated SSRF via per-user SMTP notification host (low-privilege user)

Wallos is an open-source, self-hostable personal subscription tracker. From version 2.0.0 to before version 5.0.0, any authenticated Wallos user no admin rights required can make the server open arbitrary outbound SMTP connections to internal/link-local addresses, by setting the SMTP host of thei...

CVE-2026-77966

The affected Ebyte product does not provide separation between limited and administrative management functions. A low privileged authenticated attacker could access security sensitive configuration functions and modify settings that affect the confidentiality, integrity, or availability of the...

CVE-2026-51153

Stored Cross-Site Scripting XSS in TaskRunHandler.post in web/handlers/task.py in QD 20220208 through 20250803. When a task is run via /task//run, the handler renders task log content logtmp into the HTML response using Python % string formatting without HTML encoding. logtmp is populated from th...

CVE-2026-77966 Ebyte NA111-M Missing Authorization

The affected Ebyte product does not provide separation between limited and administrative management functions. A low privileged authenticated attacker could access security sensitive configuration functions and modify settings that affect the confidentiality, integrity, or availability of the...

EUVD-2026-68613

The affected Ebyte product does not provide separation between limited and administrative management functions. A low privileged authenticated attacker could access security sensitive configuration functions and modify settings that affect the confidentiality, integrity, or availability of the...

USBvalve v1.0.1

!NOTE USBvalve Version 1.0.0 A complete rewrite of the application has been done: moved away from Arduino IDE environment, now the code is written for the Pi Pico SDK dependencies on external libraries have been reduced a lot USB host support for Low Speed devices is now more robust ATTiny85,...

DEBIAN-CVE-2026-58301

When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data. This vulnerability affects Apache Shiro versions 2.x through 3.0.0...

UBUNTU-CVE-2026-58301

When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data. This vulnerability affects Apache Shiro versions 2.x through 3.0.0...

CVE-2026-58301

When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data. This vulnerability affects Apache Shiro versions 2.x through 3.0.0...

CVE-2026-58301

When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data. This vulnerability affects Apache Shiro versions 2.x through 3.0.0...

CVE-2026-58301

CVE-2026-58301 is a Server-Side Request Forgery (SSRF) vulnerability in Apache Shiro versions 2.x through 3.0.0 , specifically affecting deployments that use the Jakarta EE integration module . A low-privileged user can craft an HTTP request that causes the server to initiate a connection to an a...

CVE-2026-40463

WaveSuite is affected by an insufficient role-based access control vulnerability in the CPB Log Files feature. Successful exploitation allows an authenticated low-privilege user to load pages restricted to higher-privilege roles by requesting the corresponding URL directly in the browser...

CVE-2026-40463: Improper Access Control

WaveSuite is affected by an insufficient role-based access control vulnerability in the CPB Log Files feature. Successful exploitation allows an authenticated low-privilege user to load pages restricted to higher-privilege roles by requesting the corresponding URL directly in the browser...