BASM (Broken Authentication & Session Management) in Jira Data Center

This High severity BASM Broken Authentication & Session Management vulnerability known as CVE-2026-21582 was introduced in version 9.12.14, 10.3.0, and 11.3.0 of Jira Software Data Center. This BASM Broken Authentication & Session Management vulnerability, with a CVSS Score of 8.8, allows an...

CVE-2026-50575 BetterDesk has a replay behavior vulnerability when devices are deleted

BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are...

EUVD-2026-60763

BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are...

CVE-2026-50575 BetterDesk has a replay behavior vulnerability when devices are deleted

BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are...

CVE-2026-50575

BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are...

DEBIAN-CVE-2026-23930

An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potential denial of service...

CVE-2026-74985

Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

CVE-2026-74952

Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 154 and Thunderbird 154...

CVE-2026-74953

Privilege escalation in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

CVE-2026-75852

ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials...

CVE-2026-75854

ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without...

CVE-2026-74907

Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching instead of directory-boundary validation. Unauthenticated attackers can access files in sibling directories by exploiting directory names that extend the base pa...

CVE-2026-15585

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in AKIN Software Computer Import Export Industry and Trade Ltd. AKINSOFT Wolvox9 ERP / KontrolPanel.exe allows Path Traversal. This issue affects AKINSOFT Wolvox9 ERP / KontrolPanel.exe: from s26.02.17 befo...

CVE-2026-23930

An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potential denial of service...

EUVD-2026-60735

An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potential denial of service...

CVE-2026-15585

A Path Traversal flaw in AKINSOFT Wolvox9 ERP's KontrolPanel.exe (versions s26.02.17 up to before 26.02.22) allows unauthenticated remote attackers to read arbitrary files. CVSS 7.5 (HIGH) reflects network-exploitable, high-confidentiality impact with no integrity or availability impact. No explo...

CVE-2026-75854 ArcadeDB Redis Wire-Protocol Plugin Missing Authentication

ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without...

CVE-2026-75854 ArcadeDB Redis Wire-Protocol Plugin Missing Authentication

ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without...

CVE-2026-75854

ArcadeDB versions before 26.8.1 expose a missing authentication flaw in the Redis wire-protocol plugin. Network attackers can connect to the Redis port with no credentials and read, write, or delete data across any server database, scoring CVSS 9.8 (CRITICAL). No exploitation evidence is provided...

EUVD-2026-60615

ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without...