611950 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-79089
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Race condition in Transactions Platform in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass...
Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: struts (UTSA-2026-031329)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-031329 advisory. ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrar...
Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098974)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098974 advisory. In the Linux kernel, the following vulnerability has been resolved: mpls: add seqcount to protect the platformlabel,s pair The RCU-protected codepaths mplsforward,...
PT-2026-82056
Name of the Vulnerable Software and Affected Versions UniFi Protect Application affected versions not specified Description An improper input validation issue allows a network-connected actor to perform command injection on the host device. Command injection is a flaw where an attacker can execut...
CVE-2026-75415
AntFlow V2.0.0 contains an Incorrect Access Control flaw in JiMuMDCCommonsRequestLoggingFilter.java . The file retrieves the user identifier from a request header and uses it as the core of its identity verification mechanism. Because this value is attacker-controllable, an unauthenticated remote...
PT-2026-82063
A malicious actor with access to the network, low privileges and under certain conditions could exploit an Active Debug Code vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances...
PT-2026-82297
Name of the Vulnerable Software and Affected Versions Weblate versions prior to 2026.7 Description The REST API fails to properly enforce the scope of project- and workspace-scoped teams. This allows a user to submit invalid team configurations, enabling them to assign projects to a team via...
PT-2026-82228
Name of the Vulnerable Software and Affected Versions Bird Home Automation GmbH D1101V-F 000140 affected versions not specified Description Incorrect access control exists due to flaws in the key derivation process and the password validation process. Recommendations At the moment, there is no...
CVE-2026-75329
The Netty configuration distribution service port 8283 of super-diamond-server = 1.3.3 has no authentication mechanism. Attackers can directly obtain the full configuration of any project including database passwords, API keys, etc. by sending a TCP request without any credential...
Entity PDF - Moderately critical - Access bypass - SA-CONTRIB-2026-114
The Entity PDF module can create a PDF from any entity based on any View mode. This module does not check entity view access when fetching a PDF route. This could result in a user accessing a PDF of an entity that they should not be able to view...
PT-2026-82096
Name of the Vulnerable Software and Affected Versions GitLab EE versions 19.1 through 19.1.6 GitLab EE versions 19.2 through 19.2.4 GitLab EE versions 19.3 through 19.3.0 Description An issue exists where an authenticated user with developer-role permissions can influence the execution environmen...
PT-2026-82324
Name of the Vulnerable Software and Affected Versions SeaweedFS versions 3.88 through 4.39 Description The SFTP server evaluates configured path permissions using a literal string-prefix comparison instead of requiring a path-component boundary. This allows an authenticated low-privilege user...
PT-2026-82066
Name of the Vulnerable Software and Affected Versions TarsWeb affected versions not specified Description Improper authorization occurs because four methods in app/controller/patch/PatchController.js fail to call the AuthService to enforce per-application roles. This allows any authenticated user...
PT-2026-82095
Name of the Vulnerable Software and Affected Versions GitLab EE versions 11.10 through 19.1.6 GitLab EE versions 19.2 through 19.2.4 GitLab EE versions 19.3 Description An authenticated user can cause a denial of service through an unbounded loop. This occurs when specially crafted input is...
PT-2026-81948
The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authorization check on a REST route that returns stored account data, allowing unauthenticated visitors to retrieve the connected service's API secr...
PT-2026-82179
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the sloppy-logic-analyzer component of the Linux kernel. The trigger write function dereferences the gpio la poll priv object without taking a debugfs...
CVE-2026-75325
DWSurvey v6.14.0 is is vulnerable to authentication bypass via the '/api/dwsurvey/none/' and '/api/dwsurvey/up/' parameters...
CVE-2025-70340
A Broken Access Control vulnerability exists in ThingsBoard Professional Edition PE 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows...
CVE-2025-70340
CVE-2025-70340 is a Broken Access Control vulnerability in ThingsBoard Professional Edition (PE) 4.21 and below , specifically within the Alarms comments functionality. An authenticated customer user can manipulate API request parameters to create or modify system-generated alarm comments , enabl...