91462 matches found
CVE-2026-16722: Improper Privilege Management
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain unauthorized privileges due to improper privilege management...
CVE-2026-58445: Observable Discrepancy
Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API...
CVE-2026-19695: Stack-based Buffer Overflow
Gammu DCT3 trace file parser crash in 4.6.0 to 4.6.7 allows denial of service...
CVE-2026-19293: Weak Password Requirements
SMP security request from peripheral does not include the maximum encryption key size supported. Using a key with less than the maximum keysize makes brute-forcing the key easier. See V6 in BLERP paper linked below...
CVE-2026-55987: Incorrect Authorization
OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens incomplete fix of 38009...
CVE-2026-28168: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in CubeWP = 1.1.30 versions...
CVE-2026-17272: Out-of-bounds Write
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a buffer overflow...
CVE-2026-66657: Improper Control of Filename for Include/Require Statement in PHP Program
Unauthenticated Local File Inclusion in Biagiotti Core = 2.1.1 versions...
CVE-2026-19292: Authentication Bypass by Primary Weakness
Re-pairing with a legitimate device can use a lower security level than previous making brute-forcing the LTK easier. See V4 in the BLERP paper linked below...
CVE-2026-17004: Loop with Unreachable Exit Condition
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an infinite loop...
CVE-2026-66689: Missing Authorization
Unauthenticated Broken Access Control in Anti Spam and list cleaner – AcyChecker = 2.0.0 versions...
CVE-2026-61979: Incorrect Privilege Assignment
Unauthenticated Privilege Escalation in SAML SP Single Sign On = 5.4.3 versions...
CVE-2026-58439: Improper Access Control
Branch Protection Bypass via PR Retargeting Preserves Stale official Approval Flag...
CVE-2026-27380: Deserialization of Untrusted Data
Editor PHP Object Injection in Car Rental Manager = 1.3.9 versions...
CVE-2026-11840: Improper Neutralization of Special Elements used in an SQL Command
Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection...
CVE-2026-17069: Cross-Site Request Forgery (CSRF)
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of anti-CSRF tokens...
CVE-2026-56443: Incorrect Authorization
Token public-only scope bypassed on Limited-visibility owners Repository + Package categories — residual after CVE-2026-25714 / PR 37118...
CVE-2026-66653: Improper Control of Filename for Include/Require Statement in PHP Program
Unauthenticated Local File Inclusion in Barista = 2.5.1 versions...