17533 matches found
CVE-2026-84789 Broken Access Control vulnerability
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to create alert notifications for firewalls outside their assigned scope...
PT-2026-97502
Name of the Vulnerable Software and Affected Versions Formie versions prior to 2.2.23 Formie versions prior to 3.1.31 Description An authenticated user can enumerate notification IDs and read recipient headers and complete HTML email bodies containing submitted form data. This occurs because the...
PT-2026-97303
Name of the Vulnerable Software and Affected Versions SUMIT Payment Gateway for WooCommerce WordPress plugin versions prior to 4.0.0 Description The plugin fails to verify the authenticity of payment notifications with the payment provider before marking an order as paid. This allows...
PT-2026-97296
Name of the Vulnerable Software and Affected Versions ManageEngine OpManager versions prior to 12.8.711 ManageEngine Firewall Analyzer versions prior to 12.8.711 Description An issue exists where an authenticated low-privilege user can bypass access controls to create alert notifications for...
CVE-2026-92039
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the DOM: Notifications component...
CVE-2026-92814
changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malicious markup in monitored page titles that reaches notification channels like email and Telegram as live content when the watchtitle token i...
CVE-2026-92814 changedetection.io through 0.60.6 Cross-Site Scripting via watch_title
changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malicious markup in monitored page titles that reaches notification channels like email and Telegram as live content when the watchtitle token i...
EUVD-2026-81072
changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malicious markup in monitored page titles that reaches notification channels like email and Telegram as live content when the watchtitle token i...
CVE-2026-92814 changedetection.io through 0.60.6 Cross-Site Scripting via watch_title
changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malicious markup in monitored page titles that reaches notification channels like email and Telegram as live content when the watchtitle token i...
CVE-2026-92814 changedetection.io through 0.60.6 Cross-Site Scripting via watch_title
changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malicious markup in monitored page titles that reaches notification channels like email and Telegram as live content when the watchtitle token i...
CVE-2026-92720
Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials and register malicious webhooks to intercept pipeline events or suppress alerting by...
EUVD-2026-80903
Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials and register malicious webhooks to intercept pipeline events or suppress alerting by...
CVE-2026-92720 Kubero through 3.1.1 Unauthenticated Notifications API Access
Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials and register malicious webhooks to intercept pipeline events or suppress alerting by...
CVE-2026-92720 Kubero through 3.1.1 Unauthenticated Notifications API Access
Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials and register malicious webhooks to intercept pipeline events or suppress alerting by...
CVE-2026-92720 Kubero through 3.1.1 Unauthenticated Notifications API Access
Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials and register malicious webhooks to intercept pipeline events or suppress alerting by...
CVE-2026-92720
Kubero through 3.1.1 fails to apply authentication guards to its notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials, register malicious webhooks to intercept pipeline events, or delete existing config...
CVE-2026-92720: Missing Authentication for Critical Function
Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials and register malicious webhooks to intercept pipeline events or suppress alerting by...
Linux Distros Unpatched Vulnerability : CVE-2026-92039
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mitigation bypass in the DOM: Notifications component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3...
