597866 matches found
PT-2026-71902
filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is enabled with default CreateUserDir setting. Unauthenticated attackers can register accounts that inherit the server root scope with full create, modify, delete, rename, share, and download permissions...
PT-2026-71873
A flaw has been found in Tenda CH, CP and TX3 V21.x/V22.x/V25.x/V26.x/V27.x. Affected by this issue is some unknown functionality of the component SSH. Executing a manipulation can lead to use of hard-coded password. It is possible to launch the attack remotely. The attack requires a high level o...
PT-2026-71557
Subscriber SQL Injection in If-So Dynamic Content Personalization = 1.10 versions...
PT-2026-71560
Unauthenticated Broken Authentication in Salon booking system = 10.30.26 versions...
PT-2026-71876
streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users' viewing status records. Attackers can enumerate all users' watch progress, delete arbitrary viewing history, and manipulate other users'...
PT-2026-71585
Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on = 2.5.1 versions...
CVE-2026-67990
Technical details are not publicly available in the provided documents; monitor for updates.
Alibaba Cloud Linux 3 : 0248: java-17-openjdk (ALINUX3-SA-2026:0248)
The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0248 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2025-66293: LIBPNG is a reference...
PT-2026-71904
luci-app-openvpn fails to properly validate the instance name2 parameter during file upload, allowing authenticated users to perform path traversal and write arbitrary files outside the intended directory. Attackers can upload malicious payloads to gain persistent root code execution by placing S...
PT-2026-71887
OpenChoreo is a developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.1, the OpenChoreo Backstage backend hardcoded backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOutsideDevelopment to true, exposing /api/ without authentication and allowing...
PT-2026-71502
Unauthenticated Cross Site Scripting XSS in Welcart e-Commerce = 2.11.31 versions...
PT-2026-71498
Subscriber Broken Access Control in Solace Extra = 1.6.0 versions...
ROS-20260813-73-0045
The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...
ROS-20260813-73-0041
The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...
ROS-20260813-73-0038
The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...
ROS-20260813-73-0026
The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...
ROS-20260813-73-0053
The vulnerability in Golang is related to the disclosure of information during data transmission. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...
ROS-20260813-73-0040
The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...
