32319 matches found
CVE-2026-92793 GoAdmin through 1.2.26 Authorization Bypass via Query Parameter
GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions, allowing authenticated users to bypass permission checks by appending a query parameter. Attackers can append a query string containing the admin prefix followed by /logout to reach administrative...
CVE-2026-76859
Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the userpassshow.cgi component. Low-privilege attackers can exploit this flaw via uiconfig2.xml and misc.js to disclose router credentials...
CVE-2026-92237
Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier allows an authenticated user with log read permission to obtain application tokens, data protection key material and other stored credentials via SQL paramet...
CVE-2026-91725
Observable discrepancy in CSS in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to leak sensitive information via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-91717
Missing authorization in Android in Google Chrome on on Android prior to 153.0.8010.47 allowed a local attacker to obtain sensitive information via a co-installed app. Chromium security severity: High...
CVE-2026-92237
The Devolutions PowerShell Universal software, versions 2026.2.5 and earlier , is vulnerable to the insertion of sensitive information into log files via the slow query logging feature . On instances backed by Microsoft SQL Server , this flaw allows an authenticated user with log read permissions...
CVE-2026-92237
Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier allows an authenticated user with log read permission to obtain application tokens, data protection key material and other stored credentials via SQL paramet...
CVE-2026-76706
CVE-2026-76706 affects the API endpoint of HPE Networking EdgeConnect SD-WAN Orchestrator , allowing an unauthenticated remote attacker to obtain sensitive information. Successful exploitation results in the disclosure of security-relevant configuration details and security feature status , which...
CVE-2026-76701 Unauthenticated Sensitive Information Disclosure in HPE Networking EdgeConnect SD-WAN Gateways
A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated remote attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to netwo...
CVE-2026-76681 Authenticated Information Disclosure Vulnerability in HPE Networking EdgeConnect SD-WAN Orchestrator API
A vulnerability in the API of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker with low privileges to access sensitive information beyond what is authorized by the user's existing privilege level. Successful exploitation could allow an attacker to retrieve information...
CVE-2026-21586
An Improper Authorization vulnerability in Confluence Data Center (Atlassian), rated CVSS 4.0: 7.1 HIGH , allows an authenticated attacker to gain unintended access to resources or functionality, potentially exposing sensitive information or enabling arbitrary code execution. The flaw was introdu...
CVE-2026-86701
Android application "ManabiPocket for Parents" contains an improper access control vulnerability in one of its components. A malicious application installed on the user's Android device may exploit the affected component via an Intent, potentially allowing the malicious application to obtain...
CVE-2026-86701
Android application "ManabiPocket for Parents" contains an improper access control vulnerability in one of its components. A malicious application installed on the user's Android device may exploit the affected component via an Intent, potentially allowing the malicious application to obtain...
CVE-2026-11864: Improper Neutralization of Data within XPath Expressions
IBM Cloud Pak for Business Automation 26.0.0 through 26.0.0 Interim Fix 001, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 008, and 24.0.0 through 24.0.0 Interim Fix 009 is vulnerable to an XPath injection vulnerability, which could allow an authenticated attacker to...
EUVD-2026-79299
An issue in Webkul Bagisto 2.4.9 allows a remote attacker to obtain sensitive information via the add-to-cart API and the downloadable fulfilment components...
PT-2026-93188
Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l7 web auth user show.cgi related to captive-portal credential handling. Attackers can query this component to obtain captive-portal user credentials, compromising confidentiality of authenticated...
PT-2026-92385
An issue in Webkul Bagisto 2.4.9 allows a remote attacker to obtain sensitive information via the add-to-cart API and the downloadable fulfilment components...
CVE-2026-86902
A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sonoma 14.8.8. An app may be able to access sensitive user data...
CVE-2026-86897
This issue was addressed with additional entitlement checks. This issue is fixed in Safari 27, iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may be able to access sensitive user data...