EUVD-2026-48716

sysPass through version 3.2.11 contains a missing authorization vulnerability that allows authenticated users with the PUBLICLINKCREATE profile flag to trigger unauthorized decryption and persistent storage of any vault account's password by exploiting the absence of AccountAcl checks in the publ...

CVE-2026-65710 sysPass 3.2.11 Missing Authorization via PublicLinkController Account Decryption

sysPass through version 3.2.11 contains a missing authorization vulnerability that allows authenticated users with the PUBLICLINKCREATE profile flag to trigger unauthorized decryption and persistent storage of any vault account's password by exploiting the absence of AccountAcl checks in the publ...

CVE-2026-65710 sysPass 3.2.11 Missing Authorization via PublicLinkController Account Decryption

sysPass through version 3.2.11 contains a missing authorization vulnerability that allows authenticated users with the PUBLICLINKCREATE profile flag to trigger unauthorized decryption and persistent storage of any vault account's password by exploiting the absence of AccountAcl checks in the publ...

CVE-2026-11571: Undefined Security Weakness

The Everest Forms WordPress plugin before 3.5.0 does not reliably delete temporary CSV files generated during email-notification processing and leaves them publicly accessible in the uploads directory, allowing unauthenticated attackers to retrieve other users' form submission records via...

CVE-2024-1480 Unitronics Vision Standard Unauthenticated Password Retrieval

Unitronics Vision Standard line of controllers allow the Information Mode password to be retrieved without authentication...

eQ-3 AG Homematic CCU3 Password Hash Disclosure Vulnerability

The eQ-3 AG Homematic CCU3 is a set of home automation controls from the German company eQ-3 AG. A password hash disclosure vulnerability exists in the User.getUserPWD method in eQ-3 AG Homematic CCU3 3.43.15 and earlier versions. An unauthenticated attacker accessing the web interface could use...

CVE-2018-14695

Incorrect access control in the /mysql/api/diags.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve diagnostic information via the "name" URL parameter...

Oracle Database 10g Multiple Remote Vulnerabilities

According to its version number, the installation of Oracle on the remote host is reportedly subject to multiple vulnerabilities, some of which don't require authentication. They may allow an attacker to craft SQL queries such that they would be able to retrieve any file on the system and...