147727 matches found
Perl-DBI Path Traversal
The vulnerability of the Perl-DBI interface for connecting to and working with databases is related to incorrect restrictions on the path name to the restricted access directory. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...
Erlang/OTP Path Traversal Unauthorized Access
The vulnerability of the Erlang/OTP software platform is related to an incorrect limitation on the path name to the restricted access directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...
Etcd RBAC Permission Bypass
The vulnerability of the RBAC permission checking mechanism when processing nested transaction operations for configuration store Etcd is related to deficiencies in the authorization mechanism. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to...
Erlang/OTP Unauthorized Access
The vulnerability of the Erlang/OTP software platform is related to the lack of protection for operational data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...
Erlang/OTP Unauthenticated Access Disclosure
The vulnerability of the Erlang/OTP software platform is related to inconsistencies in the responses to incoming requests. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...
Gitea Authentication Bypass Info Disclosure
The vulnerability of the Git repository management system Gitea is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...
MongoDB ldapQueryPassword Unauthorized Access
The vulnerability of the ldapQueryPassword parameter processing mechanism in the MongoDB database management system is related to the disclosure of information through registration files. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information...
PT-2026-99080
Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2 Description When creating or updating an email signature, the system processes inline images in the signature body. If an HTML img tag points to an existing attachment, the system copies that attachment into a ne...
PT-2026-99137
Name of the Vulnerable Software and Affected Versions Horilla versions prior to 1.6.0 Description An issue exists where the search parameter at the '/employee/employee-filter-view' endpoint is reflected via the jQuery .html method in the employee/templates/employee nav.html file without proper HT...
PT-2026-98946
Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.2 Description Zammad is a web-based open source helpdesk and customer support system. A flaw in the HTML sanitization process allows the injection of specific HTML elements into ticket bodies. When a user views a...
CVE-2026-67420: Missing Authorization
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ OAuth credential refresh retains revoked runtime tags. when an existing AMQP connection refreshes from an OAuth token that grants the impersonator tag to a valid same-username toke...
CVE-2026-89406: Missing Authorization
The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized disclosure of private gallery contents in versions up to, and including, 3.0.1. This is due to the ModulaMeta::addmetas function being hooked to wphead on every frontend request and looking up...
CVE-2026-97898: Missing Authorization
Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could...
CVE-2026-44642: Improper Neutralization of Special Elements used in an SQL Command
Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, checkupgradeaccessrights in admin/include/functionsupgrade.php conditionally escapes the submitted username only when the removed getmagicquotesgpc function exists, so PHP 8 and later concatenate an...
PT-2026-98458
Name of the Vulnerable Software and Affected Versions Akia keyless entry cloud service affected versions not specified Description An Insecure Direct Object Reference IDOR exists due to missing object-level authorization. The unlock action relies on a client-supplied room or door identifier that...
ROS-20260925-73-0191
The vulnerability of thehdrfinde function in the Linux operating system is related to reading beyond the buffer boundaries. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...
CVE-2026-92609: Session Fixation
Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended...
VulnCheck KEV: CVE-2026-42608
Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability within the FormFlash core component. By manipulating the sessionid passed as form-flash-id in POST requests, an unauthenticated attacker can traverse the filesystem to create arbitrary directories an...
PT-2026-99003
OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao used EscapeLDAPValue, an RFC 4514 distinguished-name escaping function, where RFC 4515 LDAP search-filter escaping was required in sdk/helper/ldaputil/client.go GetUserDN. With the LDAP authentication...
Jenkins Confidential Data Storage Unauthorized Access
The vulnerability of the confidential data storage mechanism in the Jenkins automation server configuration is related to the lack of measures taken to encrypt secret data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected...