1109 matches found
PT-2026-67941
Name of the Vulnerable Software and Affected Versions H3C NX15 version V100R017 Description A flaw in the Web API component allows remote attackers to access a dangerous routine. This occurs through the service.add function within the '/api/esps' endpoint. Recommendations At the moment, there is ...
CVE-2026-63456
Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive...
EUVD-2026-52440
Baileys is a cocket-based TS/JavaScript API for WhatsApp Web. In versions prior to both 6.7.22 and 7.0.0-rc12, any Baileys session can be sent a malicious payload via the placeholderResendMessage and trigger a fake messages.upsert event with a fake message key and payload. This allows anyone to...
org.apache.nifi:nifi-framework-nar (>=1.5.0, <=1.12.1), org.apache.nifi:nifi-jetty (>=1.5.0, <=1.15.3) +3 more potentially affected by CVE-2026-68981 via org.apache.nifi:nifi-web-api (>=1.5.0, <=2.10.0)
org.apache.nifi:nifi-web-api MAVEN version =1.5.0, =1.5.0, =1.5.0, =1.13.0, =1.11.0, =1.10.0, =2.10.0 Source cves: CVE-2026-68981 Source advisory: MEND:CVE-2026-68981...
org.apache.nifi:nifi-server-nar (2.0.0), org.apache.nifi:nifi-system-test-suite (2.0.0) +1 more potentially affected by CVE-2026-68980 via org.apache.nifi:nifi-web-api (>=2.0.0, <=2.10.0)
org.apache.nifi:nifi-web-api MAVEN version =2.0.0, =2.0.0, =2.10.0 Source cves: CVE-2026-68980 Source advisory: MEND:CVE-2026-68980...
org.apache.nifi:nifi-framework-nar (>=1.10.0, <=1.12.1), org.apache.nifi:nifi-jetty (>=1.10.0, <=1.15.3) +3 more potentially affected by CVE-2026-62354 via org.apache.nifi:nifi-web-api (>=1.10.0, <=2.10.0)
org.apache.nifi:nifi-web-api MAVEN version =1.10.0, =1.10.0, =1.10.0, =1.13.0, =1.11.0, =1.10.0, =2.10.0 Source cves: CVE-2026-62354 Source advisory: MEND:CVE-2026-62354...
org.apache.nifi:nifi-framework-nar (>=1.10.0, <=1.12.1), org.apache.nifi:nifi-jetty (>=1.10.0, <=1.15.3) +3 more potentially affected by CVE-2026-68979 via org.apache.nifi:nifi-web-api (>=1.10.0, <=2.10.0)
org.apache.nifi:nifi-web-api MAVEN version =1.10.0, =1.10.0, =1.10.0, =1.13.0, =1.11.0, =1.10.0, =2.10.0 Source cves: CVE-2026-68979 Source advisory: MEND:CVE-2026-68979...
PT-2026-66663
Name of the Vulnerable Software and Affected Versions Google mcp-toolbox versions 1.3.0 through 1.4.0 Description Incorrect authorization in the direct HTTP API tool invocation endpoint allows an unauthenticated attacker to invoke tools protected by the scopeRequired feature. This occurs when too...
SUSE CVE-2026-40077
Beszel is a server monitoring platform. Prior to 0.18.7, some API endpoints in the Beszel hub accept a user-supplied system ID and proceed without further checks that the user should have access to that system. As a result, any authenticated user can access these routes for any system if they kno...
CVE-2026-18005
Inappropriate implementation in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Low...
PT-2026-65727
The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Array Form Field Values in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
CVE-2026-57212
A flaw was found in RabbitMQ, a messaging and streaming broker. A remote attacker could exploit this vulnerability by sending oversized JSON bodies to the rabbitmqmanagement HTTP API. The API's body size check is incomplete, allowing the final combined size to exceed limits. This could lead to a...
CVE-2026-14603
The WowOptin: Next-Gen Popup Maker WordPress plugin (versions before 1.4.38 ) is vulnerable to an improper access control flaw on a REST endpoint . This lack of proper authorization allows unauthenticated users to perform unauthorized actions, specifically the ability to disable all opt-in forms ...
CVE-2026-47723 nebula-mesh: Web UI and API responses lack security headers (CSP, X-Frame-Options, HSTS, etc.)
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.1, none of the response paths in internal/web/ or internal/api/ set the standard browser-security headers. grep for Content-Security-Policy, X-Frame-Options, Strict-Transport-Security,...
PT-2026-63590
The Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'html' parameter in all versions up to, and including, 1.46.0 due to insufficient input sanitization and output escaping. This makes it...
CVE-2026-47731
Summary (validated by connected docs): CVE-2026-47731 affects the NASA AMMOS AIT-Core software’s Binary Stream Capture (BSC) component. An unauthenticated HTTP API under /NAME/start allows a remote attacker to trigger path traversal by supplying attacker-controlled fields (log_dir_path, path, fil...
CVE-2026-62183
Improper Privilege Management vulnerability in Apache Syncope. When: the all-Java user workflow adapter is configured, or the Flowable user workflow adapter is configured, bearing a BPMN definition not requiring admin approval for user self registration of self update requests the following...
CVE-2026-45713 Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes
Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the Mailpit SMTP server has a Server.MaxSize int field that controls the maximum allowed DATA payload size, but the field is never assigned anywhere outside test code, leaving it at Go's zero value 0 ⇒ "no limit". T...
