36553 matches found
ROS-20260901-73-0043
The vulnerability in Netty is related to the use of insufficiently random values. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...
PT-2026-84419
Name of the Vulnerable Software and Affected Versions HPE Networking Fabric Composer affected versions not specified Description A flaw in the API of HPE Networking Fabric Composer allows an unauthenticated remote attacker to perform a denial of service attack, which can disrupt the availability ...
PT-2026-84350
Name of the Vulnerable Software and Affected Versions Dell PowerStore affected versions not specified Description An incorrect authorization issue allows a low privileged attacker with remote access to potentially elevate their privileges. Recommendations At the moment, there is no information...
CVE-2026-58566: Incorrect Authorization
Dell PowerStore, an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges...
PT-2026-84349
Name of the Vulnerable Software and Affected Versions Dell PowerStore SDNAS affected versions not specified Description An issue exists where authentication is missing for a critical function. This allows an unauthenticated attacker with remote access to potentially gain access to the filesystem...
ROS-20260901-73-0031
The vulnerability in the incus is related to deficiencies in the authorization process. Exploiting this vulnerability could allow a remote attacker to gain unauthorized access to protected information...
The vulnerability of the Remote Access API interface for Windows operating systems allows attackers to escalate their privileges.
The vulnerability of the Remote Access API interface for Windows operating systems is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability can allow an attacker to increase their privileges...
The vulnerability of the DevTools component in Google Chrome and Microsoft Edge browsers allows attackers to access confidential data.
The vulnerability of DevTools components in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain access to confidential data remotely...
CVE-2026-82641: Missing Authentication for Critical Function
Keploy versions 3.1.0 through 3.6.25, fixed in 3.6.26, bind the agent control-plane HTTP server to all interfaces without authentication, exposing endpoints that stream TLS session keys and traffic data. Attackers can access the /agent/pcap/keylog endpoint to retrieve NSS keylog lines and decrypt...
CVE-2026-82477
In MITRE SAF Heimdall 2.11.6 through 2.13.x before 2.14.0, an SSRF issue allows remote attackers to access internal network resources via the Tenable proxy endpoint. This occurs in apps/backend/src/tenable/tenable.controller.ts...
Linux Distros Unpatched Vulnerability : CVE-2026-56854
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and...
CVE-2026-19294
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute and read any user's private flow due to improper authorization...
CVE-2026-56854
A flaw was found in golang.org/x/crypto/ssh. The component failed to properly enforce source-address restrictions for several authentication methods, including password and keyboard-interactive callbacks. In applications that misuse the ServerConfig.PublicKeyCallback callback to make security...
PT-2026-83330
Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.11.1 Description A path traversal issue exists that could allow a remote attacker to read arbitrary files from the system. Path traversal is a flaw that allows an attacker to access files and directori...
The vulnerabilities of the Repo.blame() and Repo.blame_incremental() functions, which are part of the security mechanism for the unsafe_git_revision_options library in the Python library for interacting with Git repositories in GitPython, allow attackers to gain unauthorized access to protected information.
The vulnerability of the Repo.blame and Repo.blameincremental functions in the GitPython library’s unsafegitrevisionoptions protection mechanism is related to the implementation or modification of arguments. Exploiting this vulnerability could allow an attacker, operating remotely, to gain...
The vulnerability of the Sandboxing component in Firefox web browsers, Firefox ESR, and the Thunderbird email client allows a intruder to access confidential data.
The vulnerability of the Sandboxing component in Firefox web browsers, Firefox ESR, and the email client Thunderbird relates to the disclosure of information in the erroneous data area. Exploiting this vulnerability can allow an attacker operating remotely to gain access to confidential data...
CVE-2026-78239 Xiiaozet LK100W Missing Authentication for Critical Function
Xiiaozet LK100W exposes a critical management function that can be invoked without authentication, allowing a remote attacker to enable administrative services that should be restricted. Successful exploitation may permit unauthorized access to the device...
Fake listings can turn trusted platforms into scam springboards
Recently, we found a listing on BuzzFeed from someone pretending to be Malwarebytes Support. It reminded us why we need to be cautious about content on platforms where anyone can create an entry. Based on the phone number, we suspect the people behind this listing are trying to draw callers into ...
CVE-2026-81094: Missing Authentication for Critical Function
The mcp-router CLI served its MCP aggregator on every interface and enforced authentication only when the operator asked for it. The serve command in apps/cli/src/commands/serve.ts defaulted its host to the all-interfaces address on a fixed port, and required a token only when the corresponding...