CVE-2026-15752 zhinianboke xianyu-auto-reply Backend User Endpoint users authorization

A vulnerability was found in zhinianboke xianyu-auto-reply up to dcb445ad97816ad65299a7580ee0c8c8f929da84. Affected is an unknown function of the file /api/v1/users/ of the component Backend User Endpoint. Performing a manipulation results in missing authorization. The attack may be initiated...

JLSEC-2026-726 wolfSSL's ECCSI signature verifier `wc_VerifyEccsiHash` decodes the `r` and `s` scalars from the...

wolfSSL's ECCSI signature verifier wcVerifyEccsiHash decodes the r and s scalars from the signature blob via mpreadunsignedbin with no check that they lie in 1, q-1. A crafted forged signature could verify against any message for any identity, using only publicly-known constants...

JLSEC-2026-704 Missing required cryptographic step in the TLS 1.3 client HelloRetryRequest handshake logic in...

Missing required cryptographic step in the TLS 1.3 client HelloRetryRequest handshake logic in wolfSSL could lead to a compromise in the confidentiality of TLS-protected communications via a crafted HelloRetryRequest followed by a ServerHello message that omits the required keyshare extension,...

CVE-2026-48325

ColdFusion is affected by a Missing Authentication for Critical Function vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed...

CVE-2026-24259

NVIDIA TensorRT-LLM for Linux contains a vulnerability where an attacker could cause missing authentication for a critical function. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...

CVE-2026-48325 ColdFusion | Missing Authentication for Critical Function (CWE-306)

ColdFusion is affected by a Missing Authentication for Critical Function vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed...

CVE-2026-48325

ColdFusion is affected by a Missing Authentication for Critical Function vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed...

CVE-2026-48325

Affected product: ColdFusion. Vulnerability: Missing Authentication for Critical Function that could allow arbitrary code execution in the context of the current user without user interaction. Impact stated as CRITICAL (CVSS 3.1: AV Adjacent, AC Low, PR None, UI None; Scope Changed; CHANGED). Lik...

CVE-2026-48325 ColdFusion | Missing Authentication for Critical Function (CWE-306)

ColdFusion is affected by a Missing Authentication for Critical Function vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed...

EUVD-2026-44542

ColdFusion is affected by a Missing Authentication for Critical Function vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the serviceAccountName field in the Kubernetes backend configuration. An attacker can gain elevated privileges by specifying an arbitrary ServiceAccount, allowing access to sensitive resources and potential ful...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the serviceAccountName field in the Kubernetes backend configuration. An attacker can gain elevated privileges by specifying an arbitrary ServiceAccount, allowing access to sensitive resources and potential ful...

GHSA-7RX3-5WX3-5V76 Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`

Summary Non-admin operators role user can set allowprivate: true on their own managed webhook subscription POST/PATCH /api/v1/webhook-subscriptions. No admin check exists on this field. At delivery time, allowprivate switches the dispatcher to an unguarded HTTP client, bypassing the...

GHSA-CM26-5974-52H8 nebula-mesh: Certificate revocation is never enforced at the mesh

Summary nebula-mesh revokes a host by adding its certificate fingerprint to a per-CA blocklist and shipping that list to every other agent on each poll. Slack's Nebula enforces certificate revocation ONLY through the pki.blocklist list in config.yml no CRL/OCSP. The project's own code states this...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the server process. An attacker can access sensitive local files by connecting to the server over the network and issuing queries that create virtual tables referencing arbitrary file paths. Remediation Upgrade...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the server process. An attacker can access sensitive local files by connecting to the server over the network and issuing queries that create virtual tables referencing arbitrary file paths. Remediation Upgrade...

Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode

Summary Anyquery's server mode lacks input sanitization and access control over its built-in SQLite virtual table modules e.g., csvreader, logreader. Unauthenticated attackers connecting to the MySQL-compatible server port can create virtual tables pointing to local files on the system e.g.,...

CVE-2026-48252

Adobe Experience Manager is affected by a Missing Authentication for Critical Function vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not...

CVE-2026-24259

CVE-2026-24259 affects NVIDIA TensorRT-LLM for Linux. The vulnerability is described as missing authentication for a critical function, with potential outcomes including code execution, data tampering, and information disclosure. According to the NVIDIA security update, for this CVE the remediati...

Missing Release of Resource after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime through the i18n.Middleware process, which processes the Accept-Language HTTP header without adequate filtering. An attacker can exhaust server CPU resources by sending specially...