235812 matches found
ManageEngine Access Manager Plus < Build 4405 SQLi (CVE-2026-14828)
According to its self-reported build number, the ManageEngine Access Manager Plus application running on the remote host is prior to build 4405. It is, therefore, affected by an authenticated SQL injection vulnerability. An authenticated, remote attacker can exploit this by crafting a malicious...
AZL-99156 CVE-2026-78662 affecting package cert-manager 1.12.15-12
Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time,...
AZL-99159 CVE-2026-56855 affecting package cert-manager 1.12.15-12
Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...
CVE-2026-75135
UpSignOn for Windows before 7.19.0 retains a backup key in the process memory of UpSignOn.exe even after the vault has been re-locked. A local attacker with low privileges can extract this key, decrypt the encrypted master password backup in v6-vault1.DATA.txt , and subsequently decrypt the entir...
EUVD-2026-68816
pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph...
@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +12 more potentially affected by CVE-2026-82393 via pnpm (>=10.0.0, <=10.33.2)
pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.0-beta.3, =0.1.8, =0.1.0, =2.7.2, =0.0.2, =0.2.5, =1.0.4, =1.0.7 Source cves: CVE-2026-82393 Source advisory: OSV:GHSA-VQ4V-J7R6-JQ4M...
@forgeax/game (>=0.3.0, <=0.3.4), @huiliyi37/cordis-plugin-loader (>=0.2.0, <=0.8.0) +7 more potentially affected by CVE-2026-82393 via pnpm (>=11.5.3, <=11.7.0)
pnpm NPM version =11.5.3, =0.3.0, =0.2.0, =0.2.4, =0.1.2, =0.1.13, =2.2.0, =2.2.12 Source cves: CVE-2026-82393 Source advisory: OSV:GHSA-VQ4V-J7R6-JQ4M...
EUVD-2026-68883
pnpm: A tarball dependency's manifest name escapes nodemodules → arbitrary file write/overwrite on install...
ROOT-APP-NPM-CVE-2026-27606 CVE-2026-27606 in rollup - Patched by Root
Root has patched CVE-2026-27606 in the rollup package for Root:npm. Multiple fixed versions available...
CVE-2026-14828
Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to an authenticated SQL Injection vulnerability...
CVE-2026-14828
Zohocorp ManageEngine products—Password Manager Pro (before 13235), PAM360 (before 8561), and Access Manager Plus (before 4405)—are vulnerable to an authenticated SQL Injection flaw. The CVSS 3.1 score is 8.8 (HIGH) with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a network-exploit...
EUVD-2026-69888
Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to an authenticated SQL Injection vulnerability...
CVE-2026-14828
Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to an authenticated SQL Injection vulnerability...
CVE-2026-84699
Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset flow. Unauthenticated attackers can reset local account passwords and authenticate as those users to gain unauthorized access...
CVE-2026-84699 Team Password Manager before 14.184.308 Authentication Bypass in Password Reset
Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset flow. Unauthenticated attackers can reset local account passwords and authenticate as those users to gain unauthorized access...
EUVD-2026-69790
Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset flow. Unauthenticated attackers can reset local account passwords and authenticate as those users to gain unauthorized access...
CVE-2026-84699
Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset flow, allowing unauthenticated attackers to reset local account passwords and authenticate as those users, resulting in unauthorized access. The vulnerability is rated CVSS 3.1...
Rockwell FactoryTalk Activation Manager <= 5.02 Privilege Escalation (SD1799)
The version of Rockwell FactoryTalk Activation Manager installed on the remote Windows host is 5.02 or prior. It is, therefore, affected by a privilege escalation vulnerability. The security issue stems from custom actions in the installer that spawn visible console windows running with SYSTEM...
PT-2026-84578
Name of the Vulnerable Software and Affected Versions Team Password Manager versions prior to 14.184.308 Description An issue exists where the software fails to enforce authentication requirements during the local account password reset flow. This allows unauthenticated attackers to reset local...