50556 matches found
CVE-2026-56320: Improper Authorization
Capgo before 12.128.2 contains an authorization flaw in POST /private/createdevice that accepts a caller-supplied orgid parameter without validating it matches the target app's owner organization. Authenticated attackers can create device records for an application using a foreign organization...
CVE-2026-58375: Missing Authentication for Critical Function
JimuReport through 2.5.0 exposes the POST /jmreport/auto/export endpoint without authentication: the handler is annotated @JimuNoLoginRequired, so JimuReportTokenInterceptor skips all authentication and authorization, and the export service streams the rendered report for any supplied report id...
PT-2026-53864
Name of the Vulnerable Software and Affected Versions fzf versions prior to 0.73.1 Description Inefficient HTTP body processing in --listen mode leads to a Denial of Service DoS. The issue stems from repeated string concatenation during the handling of POST requests, which results in quadratic ti...
A Lifecycle and Application-Stack Survey of Large Language Model Vulnerabilities: Attacks, Risks, Defenses, and Open Problems
Large language models are no longer only text generators. They are increasingly embedded in retrieval pipelines, enterprise assistants, coding environments, robotic systems, security-operation workflows, and autonomous agents that can read private data, call tools, write files, execute code, and...
PostgresSQL JDBC -- Silent channel-binding authentication downgrade via unsupported certificate algorithms
PostgreSQL project reports: channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS with channel binding to plain SCRAM-SHA-256 without it, losing the man-in-the-middle protection the setting is meant to guarantee. An attacker who can intercept the TLS connection...
PT-2026-53813
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.13 does not sanitise a form field's caption before outputting it as a column header on the administrator form-entries screen, allowing users with Contributor-level access or above to store JavaScript that executes i...
CVE-2026-11581: Undefined Security Weakness
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.13 does not sanitise a form field's caption before outputting it as a column header on the administrator form-entries screen, allowing users with Contributor-level access or above to store JavaScript that executes i...
PT-2026-53811
Name of the Vulnerable Software and Affected Versions Editorial Rating – Product Review & Rating System versions prior to 4.0.6 Description Insufficient input sanitization and output escaping allow authenticated attackers with administrator-level access and above to perform Stored Cross-Site...
CVE-2026-35096: Cross-Site Request Forgery (CSRF)
KTM System e-BOK is vulnerable to Cross‑Site Request Forgery CSRF in both the email-change and password-change functionalities. An attacker can craft a malicious website that, when visited by an authenticated user, automatically sends a forged POST request to the application. This allows the...
CVE-2026-58167: Missing Authorization
Nightingale n9e before 9.0.0-beta.2 exposes full datasource configurations, including plaintext database passwords, HTTP bearer tokens, HTTP basic-auth passwords, and mTLS client keys, to any authenticated low-privilege Standard role user through POST /api/n9e/datasource/list. The route is...
Linux Distros Unpatched Vulnerability : CVE-2026-55962
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - TLS 1.3 post-handshake authentication PHA issue where a server could accept a client's Finished message without the client having sent a Certificate and...
PT-2026-105467
Nightingale n9e before 9.0.0-beta.2 exposes full datasource configurations, including plaintext database passwords, HTTP bearer tokens, HTTP basic-auth passwords, and mTLS client keys, to any authenticated low-privilege Standard role user through POST /api/n9e/datasource/list. The route is...
CVE-2026-56968
creationtimestamp| type| source ---|---|--- 2026-06-29 23:52:40+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphonpawcs27 2026-10-13 10:19:23+00:00| seen| MISP/f8adec39-0b02-47ba-9542-6b9dafe336bd...
CVE-2026-28979
creationtimestamp| type| source ---|---|--- 2026-06-29 23:42:07+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpho2tuau22d 2026-07-01 02:51:04+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0818 2026-07-01 16:01:00+00:00| seen|...
CVE-2026-57997
creationtimestamp| type| source ---|---|--- 2026-06-29 23:18:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mphmqr4juz24 2026-06-29 23:44:23+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpho6vbvig2n 2026-06-30 14:43:34+00:00| seen|...
CVE-2025-13502
creationtimestamp| type| source ---|---|--- 2026-06-29 23:10:58+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphmd5325c2q...
CVE-2026-43746
creationtimestamp| type| source ---|---|--- 2026-06-29 22:36:28+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphkfgu6mp2k 2026-06-29 23:26:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116835979854649291 2026-07-01 02:50:40+00:00| seen|...
CVE-2026-54888
creationtimestamp| type| source ---|---|--- 2026-06-29 22:33:27+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphka2ti2e27 2026-06-29 23:30:25+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphnfwlsoh2d...
CVE-2026-43735
creationtimestamp| type| source ---|---|--- 2026-06-29 22:25:51+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphjsgcsdp2y 2026-07-01 02:50:28+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0818 2026-07-01 16:01:00+00:00| seen|...
CVE-2026-56018
creationtimestamp| type| source ---|---|--- 2026-06-29 21:56:15+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mphi5jylkh2j 2026-06-29 23:57:04+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphovl2mtc23...