600343 matches found
PT-2026-78397
phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments and attachments. Unauthenticated attackers can retrieve restricted comment text, commenter email addresses, and attachment filenames for FAQ records they cannot directly access by...
PT-2026-78449
Joomla Extension - cmsjunkie.com - Unauthenticated listing ownership takeover in J-BusinessDirectory 6.2.3 - Ownership could be changed using attacker-supplied company and user IDs, including for listings that already had an owner. 6.2.3 binds the action to the authenticated user and only allows...
EUVD-2026-62480
The Ingenic T31 SoC boot ROM flash-boot verification path compares only a single 32-bit word of the RSA signature output against a single 32-bit word of the SHA-256 payload digest, rather than compare the full data. This allows an attacker with physical write access to boot media to forge modifie...
Oracle MySQL ODBC Connector 26.7.0 < 26.7.1 (August 2026 CSPU)
The 26.7.0 versions of MySQL Connector/ODBC installed on the remote host are affected by multiple vulnerabilities as referenced in the August 2026 CSPU advisory. - Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/ODBC. The supported version that is affected is...
ROS-20260819-73-0042
The vulnerability in Tomcat10 is related to deficiencies in the authentication process. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...
Linux Distros Unpatched Vulnerability : CVE-2026-70906
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in Oracle Java SE component: 2D. Supported versions that are affected are Oracle Java SE: 25.0.4 and 26.0.2. Easily exploitable vulnerability allo...
CVE-2026-74963
Same-origin policy bypass in the Networking: Cookies component. This v...
Linux Distros Unpatched Vulnerability : CVE-2026-18691
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used...
Linux Distros Unpatched Vulnerability : CVE-2026-11817
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization...
Linux Distros Unpatched Vulnerability : CVE-2026-18692
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to b...
UBUNTU-CVE-2026-23938
An authenticated administrator is able to crash Zabbix server or proxy...
CVE-2026-50719
Ingenic T41/T32/T40/A1 SoC boot ROMs execute an attacker-controlled init table from the SPL header before secure boot verification, using 32-bit writes to disable SRAM-resident secure boot state, allowing unsigned boot code. Hardware-validated on T41; ROM analysis confirms behavior on other chips...
PT-2026-78698
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, an authenticated TURN user can place printf-style format specifiers in the STUN USERNAME or REALM attribute, which passes is secure string validation and is embedded into Redis keys at nine call sites in...
PT-2026-78407
ArcadeDB before 26.8.1 contains a server-side request forgery vulnerability in the OpenCypher LOAD CSV implementation that fails to validate HTTP/HTTPS URLs. Authenticated attackers can craft LOAD CSV queries pointing to internal network addresses or cloud metadata endpoints to make the ArcadeDB...
PT-2026-78446
Cudy WR3000 2.0 running firmware before 2.5.24 contains a hard-coded JWT HMAC signing secret vulnerability in the Mosquitto MQTT broker's authentication plugin that allows unauthenticated attackers to forge valid JWT tokens by extracting the secret from the firmware image. Attackers can use the...
ROS-20260819-73-0041
The vulnerability in Tomcat is related to deficiencies in the authentication process. Exploiting this vulnerability allows an attacker, operating remotely, to gain unauthorized access to protected information...
Linux Distros Unpatched Vulnerability : CVE-2026-18695
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaField could allow an authenticated user with write...
PT-2026-78345
Unauthenticated SQL Injection in Nikstore Core = 1.5 versions...