25444 matches found
CVE-2026-72591 Koito - Authenticated Server-Side Request Forgery via Album Image URL Parameter
A server-side request forgery SSRF vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or external hosts by supplying a crafted imageurl value in the PATCH /apis/web/v1/album/id/image endpoint...
CVE-2026-72581
CVE-2026-72581 describes a server-side request forgery in duhow/xiaoai-patch introduced by commit fb07049. The /auth endpoint in api/main.py uses a user-supplied url POST parameter to redirect to a Home Assistant instance without validating the destination URL, enabling an attacker to cause the X...
PT-2026-69953
Name of the Vulnerable Software and Affected Versions TrustyAI Service affected versions not specified Description A flaw in the TrustyAI Service TAS deployment allows any pod on the cluster network to bypass authentication and directly access the TAS backend API. This could enable an attacker to...
Photon OS 5.0: Consul PHSA-2023-5.0-91-0053
An update of the consul package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-91-0053. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
Photon OS 5.0: Curl PHSA-2026-5.0-91-0856
An update of the curl package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0856. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
PT-2026-69958
Name of the Vulnerable Software and Affected Versions ml-metadata affected versions not specified Description An outdated statically-linked gRPC stack in ml-metadata is susceptible to HTTP/2 denial of service DoS issues. An attacker with network access to the MLMD pod can send specially crafted...
VulnCheck KEV: CVE-2026-59310
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code...
CVE-2026-19352
A vulnerability was determined in mifi lossless-cut up to 3.69.0. Affected by this issue is some unknown functionality of the file src/main/httpServer.ts of the component Built-in HTTP API Service. Executing a manipulation can lead to server-side request forgery. The attack requires access to the...
EUVD-2026-54920
A vulnerability was determined in mifi lossless-cut up to 3.69.0. Affected by this issue is some unknown functionality of the file src/main/httpServer.ts of the component Built-in HTTP API Service. Executing a manipulation can lead to server-side request forgery. The attack requires access to the...
CVE-2026-19352 mifi lossless-cut Built-in HTTP API Service httpServer.ts server-side request forgery
A vulnerability was determined in mifi lossless-cut up to 3.69.0. Affected by this issue is some unknown functionality of the file src/main/httpServer.ts of the component Built-in HTTP API Service. Executing a manipulation can lead to server-side request forgery. The attack requires access to the...
CVE-2026-56848
A heap use-after-free vulnerability in the Node.js HTTP/2 component allows a remote attacker to crash the application, causing a denial of service. This is triggered by an unexpected re-entrant call to nghttp2sessionmemsend while nghttp2sessionmemrecv is still executing. Mitigation Restrict netwo...
EUVD-2026-54322
Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network...
EUVD-2026-54312
Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over a network...
EUVD-2026-54314
Improper authorization in Microsoft Power Apps allows an unauthorized attacker to elevate privileges over a network...
EUVD-2026-54321
Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network...
EUVD-2026-54216
An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials...
CVE-2026-65668
Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate privileges over a network...
CVE-2026-65667
Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network...