257863 matches found
CVE-2026-89328: Improper Access Control
The FluentBoards WordPress plugin before 2.0.15 does not properly verify that a user holds board-manager privileges before performing several board-management operations, checking only board membership. This allows any member of a board to carry out manager-only actions on it, including adding or...
CVE-2026-76186: Reliance on Cookies without Validation and Integrity Checking
Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token but takes the Keycloak access and refresh tokens used for every authorization decision from separate, unauthenticated cookies, and never checks that the two...
CVE-2026-16794: Missing Authorization
GitLab has remediated an issue in GitLab EE affecting all versions from 18.11 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user with the Security Manager role to execute arbitrary CI/CD jobs and access protected...
PT-2026-93402
Name of the Vulnerable Software and Affected Versions apache-airflow-providers-fab versions prior to 3.9.0 Description Changing a user password via the Admin user-edit PATCH endpoint fails to invalidate existing database-backed sessions. This allows an attacker possessing a victim's session cooki...
CVE-2026-82310: Insufficient Session Expiration
Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rejects the disabled account, but the Core API continues to accept an existing, unexpired token naming it, and lets that token mint a...
CVE-2026-84397: Improper Neutralization of Input During Web Page Generation
Adobe Experience Manager is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the...
PT-2026-93872
Adobe Experience Manager is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the...
CVE-2026-11984: Missing Authorization
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check on the ai-debug-code URL-parameter. This makes it possible for unauthenticated attackers to view...
RHEL 10 / 9 : Red Hat Edge Manager Version 1.2.1 Security Update (Important) (RHSA-2026:68335)
The remote Redhat Enterprise Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68335 advisory. Red Hat Edge Manager RHEM provides simple, scalable, and security-focused management of edge devices and applications. It supports...
Oracle Enterprise Manager Discovery Framework Full Control
The vulnerability of the Discovery Framework component of the Oracle Enterprise Manager Base Platform is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain full control over the application using the HTTPS protocol...
Oracle Access Manager Authentication Engine Full Control
The vulnerability of the Authentication Engine component in the Oracle Access Manager access control system is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to gain full control over the system using the HTTP network protocol...
Oracle Enterprise Manager Base Platform DoS
The vulnerability of the Agent Next Gen component of the Oracle Enterprise Manager Base Platform software platform is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service interruptions using the HTTP network protocol...
Oracle Identity Manager Legacy UI Full Control
The vulnerability of the OIM Legacy UI controller component and the Oracle Identity Manager software platform within Oracle Fusion Middleware is related to the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker, operating remotely, to gain full...
Oracle Access Manager Authentication Engine Full Control
The vulnerability of the Authentication Engine component in the Oracle Access Manager access control system is related to the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker, operating remotely, to gain full control over the application using...
Target Management Oracle Enterprise Manager Compromise
The vulnerability of the Target Management component of the Oracle Enterprise Manager Base Platform is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to compromise the system using the HTTPS protocol...
Oracle Enterprise Manager Install DoS
The vulnerability of the Install component of the Oracle Enterprise Manager Base Platform is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to cause service interruptions using the HTTPS protocol...
Oracle Identity Manager Legacy UI Access Manipulation
The vulnerability of the OIM Legacy UI component of the Oracle Identity Manager software platform in Oracle Fusion Middleware is related to insecure management of privileges. Exploiting this vulnerability could allow an attacker, operating remotely, to create, delete, or alter access to critical...
Oracle Access Manager Authentication Engine Full Control
The vulnerability of the Authentication Engine component in the Oracle Access Manager access control system is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain full control over the application through the HTTP...
Oracle Access Manager Authentication Engine Full Control
The vulnerability of the Authentication Engine component in the Oracle Access Manager access control system is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to gain full control over the system using the HTTP network protocol...
Linux Distros Unpatched Vulnerability : CVE-2026-91841
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in NetworkManager-vpnc, a VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by injecting a newline...