44523 matches found
CVE-2026-19397
creationtimestamp| type| source ---|---|--- 2026-09-08 04:47:53+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3muy7rzomjt2l 2026-09-10 14:08:55+00:00| seen| https://bsky.app/profile/deafnews-auto.bsky.social/post/3mv6a32hvfs2y...
CVE-2026-66767
creationtimestamp| type| source ---|---|--- 2026-09-08 04:02:31+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3muy5aviafu2k...
CVE-2026-76967
creationtimestamp| type| source ---|---|--- 2026-09-08 02:00:45+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3muxwh5e3xh2b...
CVE-2026-76971
creationtimestamp| type| source ---|---|--- 2026-09-08 01:53:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/723azxmg5iksy...
CVE-2026-76977
creationtimestamp| type| source ---|---|--- 2026-09-08 01:47:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/gc2ef2dilkicq...
CVE-2026-44756
creationtimestamp| type| source ---|---|--- 2026-09-08 00:47:52+00:00| seen| https://bsky.app/profile/suriq.io/post/3muxsetw6fn2t 2026-09-08 00:54:27+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117232688633335518 2026-09-08 01:02:57+00:00| seen|...
EUVD-2026-72532
Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing authenticated accounts without content permissions to upload files. Attackers can upload polyglot files with attacker-chosen extensions to the public web root and execute code if t...
CVE-2026-86538
creationtimestamp| type| source ---|---|--- 2026-09-08 00:04:29+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3muxpxaxrxg2b 2026-09-18 17:00:28+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/58eb925f-807c-4a80-aebc-629f77cefdae...
CVE-2026-86734: Uncontrolled Resource Consumption
Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/acceptance endpoint, allowing authenticated users to submit unbounded input that reaches synchronous CommonMark rendering. Attackers can submit large note values to exhaust PHP worker CPU and cause...
EUVD-2026-72850
An issue in the /cas/login component of sso-master v1.0.0 allows attackers to authenticate into the application without a password via sending a crafted POST request...
CVE-2026-73317: Incorrect Authorization
XenForo before 2.3.13 contains a missing authorization vulnerability in the ACP cache-rebuild dispatcher that allows limited administrators with only the rebuildCache permission to perform unauthorized approval queue actions by supplying an arbitrary job class and actor user ID in the POST body...
PT-2026-87153
In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operator-shaped objects as shard key values in sharded collections. When change stream events for such documents were processed with the...
CVE-2026-79577
The sso-master v1.0.0 application contains a vulnerability in its /cas/login component. This flaw allows an attacker to bypass authentication and gain access to the application without a password by sending a crafted POST request . Detailed information regarding the specific root cause, exploitab...
CVE-2026-79577: Improper Access Control
An issue in the /cas/login component of sso-master v1.0.0 allows attackers to authenticate into the application without a password via sending a crafted POST request...
PT-2026-87101
An issue in the /cas/login component of sso-master v1.0.0 allows attackers to authenticate into the application without a password via sending a crafted POST request...
CVE-2026-86590: Server-Side Request Forgery (SSRF)
In Eclipse Che versions 7.79.0 through 7.121.0, the dashboard backend's POST /dashboard/api/data/resolver endpoint passes a caller-supplied URL directly to an outbound HTTP GET request with no host filtering. An authenticated user can exploit this server-side request forgery SSRF to read response...
CVE-2026-79577
An issue in the /cas/login component of sso-master v1.0.0 allows attackers to authenticate into the application without a password via sending a crafted POST request...
CVE-2026-79577
An issue in the /cas/login component of sso-master v1.0.0 allows attackers to authenticate into the application without a password via sending a crafted POST request...
CVE-2026-86436
Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing authenticated accounts without content permissions to upload files. Attackers can upload polyglot files with attacker-chosen extensions to the public web root and execute code if t...