608779 matches found
CVE-2026-58070
A vulnerability that records guest OS processing credentials in cleartext in a support log on the guest, allowing a user with read access to that log to recover privileged account credentials...
CVE-2026-65642
Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customers' databases...
CVE-2026-55182
LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection because the signal-cli path and the Recipient field of an alert transport entry are insufficiently escaped before being passed to an exec call. An...
CVE-2026-69129 KubePi: Insufficient per-cluster authorization checks in cluster management APIs
KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 2.0.0, cluster-scoped APIs do not consistently validate per-cluster access, allowing an authenticated user with cluster management permissions to operate on clusters outside the scope they were granted. Because...
CVE-2026-69129 KubePi: Insufficient per-cluster authorization checks in cluster management APIs
KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 2.0.0, cluster-scoped APIs do not consistently validate per-cluster access, allowing an authenticated user with cluster management permissions to operate on clusters outside the scope they were granted. Because...
CVE-2026-69129
KubePi , a Kubernetes multi-cluster management panel by 1Panel-dev, contains an authorization flaw in versions up to and including 2.0.0 . Cluster-scoped APIs do not consistently validate per-cluster access, meaning an authenticated user granted management rights over one cluster can, under certa...
CVE-2025-69727
CVE-2025-69727 Fornecedor do Produto INDEX-EDUCATION Código Base do Produto Afetado PRONOTE - 202X.X.X 2025.2.8 Descrição Existe uma vulnerabilidade de Controle de Acesso Incorreto no INDEX-EDUCATION PRONOTE anterior à versão 2025.2.8. Os componentes afetados composeUrlImgPhotoIndividu permitem a...
CVE-2026-43621 Simple Machines Forum < 2.1.7 Authorization Confusion via Profile::load()
Simple Machines Forum SMF through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerability in the profile loader that allows authenticated low-privileged users to gain administrator access by supplying multiple values for the user parameter. Attackers can exploit th...
CVE-2026-77317 SeaweedFS: SFTP path ACL literal prefix match permits cross-tenant file read and overwrite
SeaweedFS is a distributed storage system for files and blobs. In versions from 3.88 through 4.39, the SFTP server evaluates configured path permissions with a literal string-prefix comparison, so a user scoped to a path is also granted the same access to any sibling path whose name merely begins...
CVE-2024-46627
CVE-2024-46627 - Controllo di accesso errato in BECN DATAGERRY v2.2 consente agli attaccanti di eseguire comandi arbitrari tramite richieste web appositamente create. DATAGERRY v2.2 non dispone di controllo degli accessi nella REST API per i seguenti endpoint: /rest/users//settings/ GET, POST...
CVE-2026-58070
A vulnerability that records guest OS processing credentials in cleartext in a support log on the guest, allowing a user with read access to that log to recover privileged account credentials...
CVE-2026-58070
CVE-2026-58070 affects Veeam Backup & Replication 13.0.2.29 and all earlier 13.x builds (Windows-based and Veeam Software Appliance deployments; older 12.x versions are not affected). The root cause is that guest OS credentials used for Application Aware processing are written in cleartext to a s...
CVE-2026-65642
Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customers' databases...
CVE-2026-65647
Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root...
CVE-2026-65642
Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customers' databases...
CVE-2026-65642
CVE-2026-65642 is an Insecure Direct Object Reference (IDOR) vulnerability in Plesk , affecting versions 18.0.79.7 and earlier and 18.0.80 through 18.0.80.3 . The flaw allows remote authenticated users to read and modify other customers' databases via the database management interface. The CVSS 4...
CVE-2026-65647
CVE-2026-65647 is an improper symlink resolution vulnerability in the Plesk Site Import and Migrator extensions. A remote authenticated (low-privilege) user can leverage this flaw to execute arbitrary code as root , resulting in full compromise of the vulnerable system. The CVSS 4.0 score is 8.7 ...
CVE-2026-77507
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, Weblate's object-scoped RSS feeds do not apply the permission checks used elsewhere, allowing unauthorized users to read change-history metadata from private projects and...
CVE-2026-75415
AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java retrieves the userid from the request header as the core of the identity verification mechanism, allowing attackers to forge any user identity credential information, thereby causing sensitive...