CVE-2026-104991 Phproject < 1.8.7 Missing Authorization via Issues REST API

Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints singleget, singlecomments, singlecommentspost that allows authenticated API key holders to bypass the security.restrictaccess confidentiality control by never invoking the allowAcces...

CVE-2026-104991

Phproject versions prior to 1.8.7 are affected by a missing object-level authorization vulnerability within the REST API issue endpoints, specifically single_get, single_comments, and single_comments_post. The root cause is the failure to invoke the allowAccess() authorization routine, allowing a...

CVE-2026-23933

A flaw was found in Zabbix. The cryptographic key used for signing Frontend sessions was erroneously written to the database seed. In deployments that utilize both SAML authentication and guest users, an attacker could use this key to forge valid session cookies. This could potentially lead to...

CVE-2026-101104

The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate configurations of devices they do not own. By exploiting this flaw, an attacker can alter device settings, trigger unintended behaviors, or access sensitive informatio...

WordPress PublishPress Series plugin <= 3.1.3 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by dcs in WordPress Plugin PublishPress Series versions = 3.1.3...

CVE-2026-103505

A flaw was found in the AWS Elastic File System EFS Container Storage Interface CSI Driver. A remote authenticated user with permissions to create persistent storage volumes can supply crafted comma-separated values within volume configuration attributes. This improper input handling allows the...

axios: axios: Unintended HTTP method override via prototype pollution gadget

A flaw was found in axios. When sending HTTP requests that omit an explicit request method, Axios can inherit properties from the JavaScript prototype chain rather than using safe internal defaults. If an attacker manipulates shared object properties through a separate vulnerability in the same...

CVE-2026-86326

A vulnerability exists in protocol gateways due to an improper verification of cryptographic signatures . The device fails to verify the cryptographic authenticity of firmware images before installation. An attacker with high privileges and access to the firmware update interface can provide a sp...

CVE-2026-86326

An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify the cryptographic authenticity of firmware images before installation. An attacker with high privileges and access to the firmware update interface could provi...

EUVD-2026-91373

An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify the cryptographic authenticity of firmware images before installation. An attacker with high privileges and access to the firmware update interface could provi...

axios: axios: Unintended HTTP method override via prototype pollution gadget

A flaw was found in axios. When sending HTTP requests that omit an explicit request method, Axios can inherit properties from the JavaScript prototype chain rather than using safe internal defaults. If an attacker manipulates shared object properties through a separate vulnerability in the same...

httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response

A flaw was found in httpd. When configured as a forward proxy using the modproxyftp module, the server improperly validates the network address returned in a File Transfer Protocol FTP passive mode PASV response. A malicious FTP server can exploit this flaw by returning a crafted reply, forcing t...

Exploit for CVE-2026-104356

CVE-2026-104356 — Predictable deletecode via rand in Pi...

CVE-2026-104480

Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resulting group roster contained an unrecognized participant. An attacker in control of the DAVE signaling path the voice gateway, or an equivalent position able to add, alter, or withhold signaling messages to a client...

ZOHO WebNMS Framework <5.2 SP1 - Local File Inclusion

ZOHO WebNMS Framework before version 5.2 SP1 is vulnerable local file inclusion which allows an attacker to read arbitrary files via a .. dot dot in the fileName parameter to servlets/FetchFile. id: CVE-2016-6601 info: name: ZOHO WebNMS Framework 5.2 SP1 - Local File Inclusion author: 0xAkoko...

Splunk <=7.0.1 - Information Disclosure

Splunk through 7.0.1 is susceptible to information disclosure by appending raw/services/server/info/server-info?outputmode=json to a query, as demonstrated by discovering a license key. id: CVE-2018-11409 info: name: Splunk =7.0.1 - Information Disclosure author: harshbothra severity: medium...

CVE-2026-103923

A flaw was found in KaTeX. When JavaScript prototype pollution is present or an attacker can manipulate configuration prototypes, KaTeX improperly relies on inherited properties instead of strictly validated configuration options. A remote attacker submitting crafted mathematical expressions can...

CVE-2026-63045

A flaw was found in httpd. When configured as a forward proxy using the modproxyftp module, the server improperly validates the network address returned in a File Transfer Protocol FTP passive mode PASV response. A malicious FTP server can exploit this flaw by returning a crafted reply, forcing t...

CVE-2026-104480 Improper MLS Welcome roster validation in Discord libdave allows unauthorized group membership

Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resulting group roster contained an unrecognized participant. An attacker in control of the DAVE signaling path the voice gateway, or an equivalent position able to add, alter, or withhold signaling messages to a client...

CVE-2026-104480 Improper MLS Welcome roster validation in Discord libdave allows unauthorized group membership

Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resulting group roster contained an unrecognized participant. An attacker in control of the DAVE signaling path the voice gateway, or an equivalent position able to add, alter, or withhold signaling messages to a client...