82431 matches found
CVE-2026-46459
ICU Scandinavia Boomerang is affected by a missing authentication vulnerability in its device receiver endpoints. An unauthenticated remote attacker can read full facility configurations and write unauthorized data to the sensor database. The issue is mitigated by upgrading to version 2.4.18.029....
CVE-2026-46459 Missing Authorization in ICU Scandinavia Boomerang
ICU Scandinavia Boomerang is vulnerable to a missing authentication flaw in its device receiver endpoints. This allows an unauthenticated remote attacker to read full facility configurations and write unauthorized data to the sensor database. This issue has been fixed in version 2.4.18.029...
CGA-H8PX-QQMP-PHXV
Bulletin has no description...
CVE-2026-15779
Summary: CVE-2026-15779 concerns Samba’s pam_winbind when mkhomedir is enabled. pam_winbind chowns the target account’s home directory without validating that the path is not a critical system directory like “/”. On systems where / is a user home (a common default for system accounts), this can b...
DEBIAN-CVE-2026-61872
ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the TIFF encoder when an invalid tiff:tile-geometry is specified. Supplying malformed tile geometry parameters causes allocated memory not to be released, which can lead to increased memory consumption...
CVE-2026-61452
The Grav API plugin getgrav/grav-plugin-api before 2.0.4 contains an improper session invalidation vulnerability where JWT access tokens are issued without a jti JWT ID claim and therefore cannot be revoked server-side. Unlike refresh tokens, access tokens remain valid for their full lifetime...
EUVD-2026-44638
PraisonAI before 4.6.78 exposes the MCP HTTP-stream transport without authentication by default: the CLI --api-key option defaults to None, and the server only enforces Authorization/Bearer checks when an API key is configured. When an operator runs 'praisonai mcp serve --transport http-stream'...
CVE-2026-57996
phpMyFAQ prior to 4.1.5 contains a privilege-escalation flaw in the admin/user-add endpoint. A delegated administrator with USER_ADD/EDIT/DELETE can call POST /admin/api/user/add using isSuperAdmin: true and attacker-chosen credentials to create a SuperAdmin account, enabling full instance takeov...
CVE-2026-59235
Missing Authorization CWE-862 in BankAccountListController app/Http/Controllers/Api/BankAccount/BankAccountListController.php, exposed at GET /api/bank-account, in Prospero Flow CRM companyid-get, performing only company scoping and no role or permission check before returning the data. This...
MINI-5954-HWXH-7CRJ
Bulletin has no description...
MINI-J7RX-6RC8-PP28
Bulletin has no description...
MINI-5R5Q-Q4CC-53GW
Bulletin has no description...
MINI-JP83-53VC-CQG2
Bulletin has no description...
MINI-2Q5G-WRHH-GG4H
Bulletin has no description...
MINI-5QJM-2587-CX3M
Bulletin has no description...
MINI-9PJG-P2WW-X9J4
Bulletin has no description...
MINI-JH4C-7G9R-GPJG
Bulletin has no description...
MINI-H7VP-5RRQ-5JV7
Bulletin has no description...