46999 matches found
CVE-2026-37064
User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via sending a specially crafted POST request to the affected endpoint with a chosen 'username' parameter to test if the user exists...
CVE-2026-37073: Improper Access Control
Incorrect access control in /vfm-admin/ajax/sendfiles.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to send emails from the configured SMPT server on the application via making a POST request to the endpoint with needed parameters and header...
CVE-2026-37068: Improper Limitation of a Pathname to a Restricted Directory
Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected endpoint...
PT-2026-82445
Name of the Vulnerable Software and Affected Versions ACPT Pro - Custom Post Types Plugin for WordPress versions prior to 2.0.64 Description An unauthenticated privilege escalation issue allows an attacker to create a WordPress administrator account. This flaw has been exploited in the wild via t...
CVE-2026-30073
The free5gc v4.0.1 software contains a vulnerability in the NssaiAvailabilitySubscriptionCreate component. An attacker can trigger a Denial of Service (DoS) by sending a crafted POST request . The RAPID7 documentation indicates that the underlying cause is an Allocation of Resources Without Limit...
PT-2026-82537
An issue in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted POST request...
CVE-2026-37067
Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all application logs from a desired date forwards via a specially crafted POST request...
EUVD-2026-67121
An issue in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted POST request...
EUVD-2026-67266
User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via sending a specially crafted POST request to the affected endpoint with a chosen 'username' parameter to test if the user exists...
CVE-2026-80208: Missing Authentication for Critical Function
APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount in InternalUserController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxi...
CVE-2026-30073
An issue in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted POST request...
CVE-2026-30073
An issue in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted POST request...
CVE-2026-37064: Observable Discrepancy
User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via sending a specially crafted POST request to the affected endpoint with a chosen 'username' parameter to test if the user exists...
PT-2026-82604
openssl encrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with unencrypted embedded PQC keys that decrypt under any password, bypassing authentication and producing attacker-chosen plaintext with fals...
CVE-2026-75960
creationtimestamp| type| source ---|---|--- 2026-08-26 23:01:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtzgtq67as27 2026-08-28 09:13:12+00:00| seen| https://bsky.app/profile/r-netsec-bot.bsky.social/post/3mu4zic6ge32e 2026-08-28 11:09:31+00:00| seen|...
CVE-2026-77317
creationtimestamp| type| source ---|---|--- 2026-08-26 23:00:15+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtzgrdrgwo2r 2026-08-27 00:08:02+00:00| seen| https://bsky.app/profile/termsofsurrender.bsky.social/post/3mtzkkkep2t23...
CVE-2026-17436
creationtimestamp| type| source ---|---|--- 2026-08-26 21:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtzagzy75k2m...
CVE-2026-74770
creationtimestamp| type| source ---|---|--- 2026-08-26 21:01:25+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtza4tg2fu2r 2026-08-29 02:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mu6tsxdmsp24...