87206 matches found
PT-2026-103094
Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description Insufficient sanitization of the username input on the password reset page allows a remote attacker to perform a cross-site scripting XSS attack. XSS is a flaw where malicious scripts are...
CVE-2026-102586: Improper Neutralization of Input During Web Page Generation
A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting XSS attack. By convincing an unauthenticated user to access a specially crafted password reset link, an attacker could execute arbitrary...
CVE-2026-100255: Improper Validation of Unsafe Equivalence in Input
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset...
PT-2026-103134
Name of the Vulnerable Software and Affected Versions Apache WSS4J versions prior to 4.0.2 Apache WSS4J versions prior to 3.0.6 Apache WSS4J versions prior to 2.4.4 Description An issue exists in the handling of the Nonce within the UsernameToken. The software stores the Nonce as raw base64 text,...
CVE-2026-92899: Authentication Bypass by Spoofing
Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but authentication decodes that text and uses the bytes.The same bytes can be written as base64 in several ways. An attacker who captured an authenticat...
AlmaLinux 9.2 [TuxCare] Security Update: mysql / mysql-common / mysql-devel / mysql-errmsg / mysql-libs / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1741637440)
The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1741637440 advisory. - When asked to both use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first...
AlmaLinux 9.2 [TuxCare] Security Update: grafana (ALMALINUX9.2:CLSA-2025:1758135826)
The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1758135826 advisory. - Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is ma...
CentOS Linux 7 [TuxCare] Security Update: ctdb / ctdb-tests / libsmbclient / libsmbclient-devel / libwbclient / etc (CENTOS7:CLSA-2026:1782977299)
The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1782977299 advisory. - A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the...
AlmaLinux 9.6 [TuxCare] Security Update: grafana / grafana-selinux (ALMALINUX9.6:CLSA-2026:1777944610)
The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777944610 advisory. - When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. ...
AlmaLinux 9.2 [TuxCare] Security Update: ctdb / libnetapi / libnetapi-devel / libsmbclient / etc (ALMALINUX9.2:CLSA-2026:1782204526)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1782204526 advisory. - A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use t...
CVE-2026-100296
In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, an empty-body POST to /setUserConfig, dispatched through the web server's SOAP-RPC handler, silently downgrades the administrator password to the default value and corrupts the in-memory authentication state until the device reloads. The handler...
EUVD-2026-89408
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, the device includes a legacy password hash on the serial console that relies on a weak DES‑based encryption...
CVE-2026-100296 Improper Check for Unusual or Exceptional Conditions in Anjvision YSSD-RTMP-H5
In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, an empty-body POST to /setUserConfig, dispatched through the web server's SOAP-RPC handler, silently downgrades the administrator password to the default value and corrupts the in-memory authentication state until the device reloads. The handler...
CVE-2026-100296 Improper Check for Unusual or Exceptional Conditions in Anjvision YSSD-RTMP-H5
In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, an empty-body POST to /setUserConfig, dispatched through the web server's SOAP-RPC handler, silently downgrades the administrator password to the default value and corrupts the in-memory authentication state until the device reloads. The handler...
EUVD-2026-89405
In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, an empty-body POST to /setUserConfig, dispatched through the web server's SOAP-RPC handler, silently downgrades the administrator password to the default value and corrupts the in-memory authentication state until the device reloads. The handler...
CVE-2026-100296
In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4 , a vulnerability exists in the web server's SOAP-RPC handler . An attacker with any authenticated user privileges can send an empty-body POST request to /setUserConfig to trigger a silent downgrade of the administrator password to its default va...
CVE-2026-95364
An improper input validation flaw was found in the Passwords component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553271219...
CVE-2026-95312
An information leak flaw was found in the Passwords component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/547832510...