87245 matches found
PT-2026-93401
Name of the Vulnerable Software and Affected Versions apache-airflow-providers-fab versions prior to 3.9.0 Description Resetting a user password fails to delete existing database-backed sessions when using the FAB auth manager with fab session backend=database. This occurs because the cleanup...
CVE-2026-82311: Insufficient Session Expiration
Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cleanup compares the string identifier Flask-Login stores in the session against the user's integer database identifier, so the...
PT-2026-93733
Name of the Vulnerable Software and Affected Versions zlt2000 microservices-platform versions prior to 6.0.1 Description An unverified password change issue exists in the 'PUT /users/password' endpoint. Authenticated users can change the password of any non-administrator account by omitting the...
PT-2026-94071
Name of the Vulnerable Software and Affected Versions OpenSign versions prior to 2.41.4 Description The getDocument cloud function fails to validate the identity of the caller when one-time-password verification is disabled. An attacker can provide a document identifier obtained from guest signin...
CVE-2026-92467: Unverified Password Change
zlt2000 microservices-platform through 6.0.0 contains an unverified password change vulnerability in the PUT /users/password endpoint that allows authenticated users to change any account password by omitting the current password check. Attackers can supply an arbitrary user id in the request bod...
CVE-2026-92578: Improper Authentication
WWBN AVideo through 29.0 contains an authentication bypass vulnerability where the stored password hash is accepted as a valid login credential through two independent code paths in loginFromRequest and encryptPasswordVerify. Attackers who obtain the stored users.password hash value can...
PT-2026-93297
The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalise a donor's e-mail address between the value it stores and the value it later uses to look that donor up, allowing unauthenticated users to be resolved as an arbitrary donor and to set the WordPress password of any user...
PT-2026-93346
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A low-privileged remote attacker with a valid user cookie can manipulate the schema path parameter in the '/index.php/diagnostics tab/ajax diag table rows'...
CVE-2026-20072: Incorrect Authorization
A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to obtain sensitive information from network users that are outside the security group that the attacker is assigned to. This vulnerability exists because certain files lack proper...
CVE-2026-90969
Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking the view-password permission to obtain cleartext passwords via a request to the entry listing endpoint with password disclosure parameters...
CVE-2026-19641
On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legitimate users being unable to log in to the...
CVE-2026-90969
Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking the view-password permission to obtain cleartext passwords via a request to the entry listing endpoint with password disclosure parameters...
CVE-2026-90969
An improper access control vulnerability exists in the vault entry listing feature of Devolutions Server 2026.2.16 and earlier versions. This flaw allows an authenticated user who lacks the specific view-password permission to obtain cleartext passwords . The vulnerability is triggered by sending...
EUVD-2026-79185
Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking the view-password permission to obtain cleartext passwords via a request to the entry listing endpoint with password disclosure parameters...
CVE-2026-73466
CVE-2026-73466 affects Arista EOS , where plaintext user passwords may be written to log files (/var/log/agents/Aaa-*) under CWE-532 (Insertion of Sensitive Information into Log File). The precondition is that PyServer trace level 4 on agent Aaa is explicitly enabled via a non-standard debugging ...
CVE-2026-19641 On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legit
On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legitimate users being unable to log in to the...
EUVD-2026-79141
On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legitimate users being unable to log in to the...
CVE-2026-19641
CVE-2026-19641 affects Arista EOS devices where password-based login authentication is enabled (e.g., SSH password or Telnet). Due to CWE-116 (Improper Encoding or Escaping) , a specially crafted password can create orphan authentication sessions that accumulate in a limited session pool, eventua...
CVE-2026-19641 On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legit
On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legitimate users being unable to log in to the...