CVE-2025-27904

IBM DB2 Recovery Expert for LUW 5.5 Interim Fix 002 IBM Db2 Recovery Expert for Linux, UNIX and Windows is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

CVE-2025-27903

IBM DB2 Recovery Expert for LUW 5.5 Interim Fix 002 IBM Db2 Recovery Expert for Linux, UNIX and Windows transmits data in a cleartext communication channel that could allow an attacker to obtain sensitive information using man in the middle techniques...

CVE-2025-27899

IBM DB2 Recovery Expert for LUW 5.5 Interim Fix 002 discloses sensitive information in an environment variable that could aid in further attacks against the system...

CVE-2025-27898

IBM DB2 Recovery Expert for LUW 5.5 Interim Fix 002 does not invalidate session after a timeout which could allow an authenticated user to impersonate another user on the system...

CVE-2026-1344

Tanium addressed an insecure file permissions vulnerability in Enforce Recovery Key Portal...

CVE-2025-27901

IBM DB2 Recovery Expert for LUW 5.5 Interim Fix 002 IBM Db2 Recovery Expert for Linux, UNIX and Windows is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system,...

CVE-2026-1670

The affected products are vulnerable to an unauthenticated API endpoint exposure, which may allow an attacker to remotely change the "forgot password" recovery email address...

FormaLMS 安全漏洞

FormaLMS is an open-source learning management system developed by Forma.association. It is designed to meet specific needs related to corporate training. Versions of FormaLMS prior to 4.1.18 contained a security vulnerability. This vulnerability stemmed from the password recovery function, which...

CVE-2026-26744

A user enumeration vulnerability exists in FormaLMS 4.1.18 and below in the password recovery functionality accessible via the /lostpwd endpoint. The application returns different error messages for valid and invalid usernames allowing an unauthenticated attacker to determine which usernames are...

CVE-2026-26744

A user enumeration vulnerability exists in FormaLMS 4.1.18 and below in the password recovery functionality accessible via the /lostpwd endpoint. The application returns different error messages for valid and invalid usernames allowing an unauthenticated attacker to determine which usernames are...

PT-2026-20941

Name of the Vulnerable Software and Affected Versions FormaLMS versions 4.1.18 and below Description A flaw exists in the password recovery functionality of FormaLMS that allows for user enumeration. An unauthenticated attacker can determine valid registered usernames by observing differing error...

CVE-2026-26744

A user enumeration vulnerability exists in FormaLMS 4.1.18 and below in the password recovery functionality accessible via the /lostpwd endpoint. The application returns different error messages for valid and invalid usernames allowing an unauthenticated attacker to determine which usernames are...

CVE-2026-26744

FormaLMS is affected version 4.1.18 and earlier. A user enumeration flaw exists in the password recovery endpoint (/lostpwd) where responses differ between valid and invalid usernames, allowing unauthenticated attackers to determine registered usernames. Impact is limited to information disclosur...

CVE-2025-36425

IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 could allow an authenticated user to obtain sensitive information under specific HADR configuration...

CVE-2026-1344

Tanium addressed an insecure file permissions vulnerability in Enforce Recovery Key Portal...

CVE-2026-1344

Tanium addressed an insecure file permissions vulnerability in Enforce Recovery Key Portal...

PT-2026-20491

Name of the Vulnerable Software and Affected Versions strongMan versions prior to 0.2.0 Description strongMan, a management interface for strongSwan, improperly encrypted credentials stored in its database. The software used AES in CTR mode with a global database key and a consistent initializati...

Tanium Enforce Recovery Key Portal 安全漏洞

Tanium Enforce Recovery Key Portal is a component of the US-based Tanium company that allows access to disk encryption recovery keys. There is a security vulnerability in Tanium Enforce Recovery Key Portal, which stems from insecure file permissions. This vulnerability may allow attackers with...

CVE-2026-1344 Insecure file permissions in Enforce Recovery Key Portal

Tanium addressed an insecure file permissions vulnerability in Enforce Recovery Key Portal...

CVE-2026-1344

CVE-2026-1344 concerns an insecure file permissions vulnerability in Tanium’s Enforce Recovery Key Portal. The available documents consistently describe insecure file permissions as the underlying issue, with exposure to high confidentiality impact. Concrete details on affected versions, root cau...