87093 matches found
AlmaLinux 9.6 [TuxCare] Security Update: grafana / grafana-selinux (ALMALINUX9.6:CLSA-2026:1777944610)
The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777944610 advisory. - When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. ...
CentOS Linux 7 [TuxCare] Security Update: ctdb / ctdb-tests / libsmbclient / libsmbclient-devel / libwbclient / etc (CENTOS7:CLSA-2026:1782977299)
The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1782977299 advisory. - A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the...
CVE-2026-102586: Improper Neutralization of Input During Web Page Generation
A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting XSS attack. By convincing an unauthenticated user to access a specially crafted password reset link, an attacker could execute arbitrary...
PT-2026-103094
Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description Insufficient sanitization of the username input on the password reset page allows a remote attacker to perform a cross-site scripting XSS attack. XSS is a flaw where malicious scripts are...
CVE-2026-92899: Authentication Bypass by Spoofing
Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but authentication decodes that text and uses the bytes.The same bytes can be written as base64 in several ways. An attacker who captured an authenticat...
CVE-2026-102115: Weak Password Recovery Mechanism for Forgotten Password
Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally stored password could potentially reset that account's password without access to the emailed reset link and then...
PT-2026-103548
Name of the Vulnerable Software and Affected Versions Kiteworks Core versions prior to 9.5.1 Description Kiteworks Core fails to correctly validate a parameter within the password reset workflow. This allows an unauthenticated attacker who knows the email address of a user with a locally stored...
PT-2026-103596
Name of the Vulnerable Software and Affected Versions Kiteworks Email Protection Gateway affected versions not specified Description An administrative service in Kiteworks Email Protection Gateway fails to consistently enforce administrator authentication, allowing the password check to be...
AlmaLinux 9.2 [TuxCare] Security Update: mysql / mysql-common / mysql-devel / mysql-errmsg / mysql-libs / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1741637440)
The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1741637440 advisory. - When asked to both use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first...
CVE-2026-100296
In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, an empty-body POST to /setUserConfig, dispatched through the web server's SOAP-RPC handler, silently downgrades the administrator password to the default value and corrupts the in-memory authentication state until the device reloads. The handler...
EUVD-2026-89408
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, the device includes a legacy password hash on the serial console that relies on a weak DES‑based encryption...
CVE-2026-100296 Improper Check for Unusual or Exceptional Conditions in Anjvision YSSD-RTMP-H5
In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, an empty-body POST to /setUserConfig, dispatched through the web server's SOAP-RPC handler, silently downgrades the administrator password to the default value and corrupts the in-memory authentication state until the device reloads. The handler...
CVE-2026-100296 Improper Check for Unusual or Exceptional Conditions in Anjvision YSSD-RTMP-H5
In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, an empty-body POST to /setUserConfig, dispatched through the web server's SOAP-RPC handler, silently downgrades the administrator password to the default value and corrupts the in-memory authentication state until the device reloads. The handler...
EUVD-2026-89405
In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, an empty-body POST to /setUserConfig, dispatched through the web server's SOAP-RPC handler, silently downgrades the administrator password to the default value and corrupts the in-memory authentication state until the device reloads. The handler...
CVE-2026-100296
In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4 , a vulnerability exists in the web server's SOAP-RPC handler . An attacker with any authenticated user privileges can send an empty-body POST request to /setUserConfig to trigger a silent downgrade of the administrator password to its default va...
CVE-2026-95364
An improper input validation flaw was found in the Passwords component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553271219...
CVE-2026-95312
An information leak flaw was found in the Passwords component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/547832510...
CVE-2026-22101
The access to the service menu is obfuscated, but possible with only physical access. This menu exposes sensitive information such as serial numbers, MAC addresses, and WiFi network and password...