256648 matches found
PT-2026-71645
During an internal security assessment, a potential vulnerability was discovered in Lenovo Dock Manager that could allow an authenticated local user to perform an arbitrary file deletion with elevated privileges...
PT-2026-71644
During an internal security assessment, a potential improper permissions vulnerability was discovered in Lenovo Dock Manager that could allow a local authenticated user to execute arbitrary code with elevated privileges...
PT-2026-71496
Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce = 2.0.3 versions...
CVE-2026-11840: Improper Neutralization of Special Elements used in an SQL Command
Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection...
PT-2026-71397
Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection...
PT-2026-71419
Zohocorp ManageEngine Password Manager Pro versions before 13232 and PAM360 versions before 8551 are vulnerable to an authentication bypass vulnerability due to improper SAML validation...
CVE-2026-63425: Incorrect Default Permissions
During an internal security assessment, a potential improper permissions vulnerability was discovered in Lenovo Dock Manager that could allow a local authenticated user to execute arbitrary code with elevated privileges...
CVE-2026-27345: Missing Authorization
Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce = 2.0.3 versions...
CVE-2026-63423: Use of Hard-coded Cryptographic Key
During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise for Windows that could allow a local authenticated user to execute arbitrary code with elevated privileges...
PT-2026-71643
During an internal security assessment, an improperly protected key was discovered in Lenovo Dock Manager that could allow a local authenticated user to escalate privileges...
PT-2026-71497
Editor PHP Object Injection in Car Rental Manager = 1.3.9 versions...
CVE-2026-73583: Out-of-bounds Read
A flaw was found in sblim-sfcb. A local attacker with access to the system can exploit an unsafe deserialization vulnerability in the provider-manager's inter-process communication IPC message parsing. By sending a specially crafted message, the attacker can cause out-of-bounds memory access,...
CVE-2026-12263: Improper Verification of Cryptographic Signature
Zohocorp ManageEngine Password Manager Pro versions before 13232 and PAM360 versions before 8551 are vulnerable to an authentication bypass vulnerability due to improper SAML validation...
CVE-2026-63424: Weak Encoding for Password
During an internal security assessment, an improperly protected key was discovered in Lenovo Dock Manager that could allow a local authenticated user to escalate privileges...
CVE-2026-73416: Improper Handling of Case Sensitivity
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.0 until 4.5.10 and 4.6.2, in jupyterlab/extensions/manager.py and jupyterlab/extensions/pypi.py, JupyterLab's PyPI extension manager enforces...
CVE-2026-63426: Improper Link Resolution Before File Access
During an internal security assessment, a potential vulnerability was discovered in Lenovo Dock Manager that could allow an authenticated local user to perform an arbitrary file deletion with elevated privileges...
CVE-2026-73627: Client-Side Enforcement of Server-Side Security
JupyterLab pip package 'jupyterlab' versions =4.1.0,=4.6.0,=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow an authenticated user to circumvent administrator lock rules by making direct requests to the /lab/api/plugins endpoint, enabling or...
PT-2026-71886
Name of the Vulnerable Software and Affected Versions FreePBX versions prior to 17.0.9 Description The UCP Node server on ports 8001 and 8003 utilizes io.usecheckAuth in node/lib/server.js. However, Socket.IO version 4 only applies this middleware to the default namespace. This allows an...
