114687 matches found
CVE-2026-53952: Improper Authorization
GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. A logic flaw in GetSimple CMS v3.4.0a and below and GetSimpleCMS-CE v3.3.22 and below allows unauthenticated attackers to create a new administrator account. The application features an...
CVE-2026-89444: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer setattribute populates the security area of the BIOS attribute request buffer with the current admin password via populatesecuritybuffer, then dumps the whol...
CVE-2025-69904
Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an administrator to read arbitrary files on the server by manipulating file path input. Successful exploitation may lead to unauthorized access to sensitive system or application files...
Palo Alto Networks PAN-OS 10.0.x / 10.2.x / 11.0.x / 8.1.x / 9.0.x / 9.1.x Vulnerability
The version of Palo Alto Networks PAN-OS running on the remote host is a vulnerable version of 8.1.x, 9.0.x, 9.1.x, 10.0.x, 10.2.x, or 11.0.x. It is, therefore, affected by a vulnerability. A cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS software enables a malicious...
PT-2026-90160
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the dell-wmi-sysman module where the set attribute function populates the security area of the BIOS attribute request buffer with the current admin password using...
PT-2026-90518
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description When a specific authentication mode is configured, the reverse proxy forwards requests for a bundled third-party administrative interface directly to that...
PT-2026-90047
Name of the Vulnerable Software and Affected Versions Xiongmai IP Camera XM530 versions prior to HMT.CM2005-v220608.1837 Description The device uses hardcoded default credentials that are stored in unencrypted plaintext within the bin/config.xml file and compiled into the Sofia executable. This...
PT-2026-89884
Name of the Vulnerable Software and Affected Versions Puppet Enterprise versions 2023.8.0 through 2023.8.10 Puppet Enterprise versions 2025.0.0 through 2025.11.2 Description An authenticated user with administrative privileges can execute arbitrary shell commands by providing a specially crafted...
CVE-2026-89660: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during admin state revocation A stateid holds only a bare pointer to its nfs4client; a stateid reference does not pin it. The client survives only because destroyclient drains its stateids befo...
PT-2026-89846
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in UserGroups::setGroup name that fails to sanitize group name input. Administrators with canAdminUserGroups permission can inject malicious HTML and JavaScript that executes i...
PT-2026-96463
In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer set attribute populates the security area of the BIOS attribute request buffer with the current admin password via populate security buffer, then dumps the...
Ivanti Endpoint Manager Mobile < 12.8.0.4 / 12.9.x < 12.9.0.2 / 12.10.0.0 Privilege Escalation (CVE-2026-18851)
The version of Ivanti Endpoint Manager Mobile, formerly MobileIron Core, running on the remote host is prior to 12.8.0.4, or 12.9.x prior to 12.9.0.2. It is, therefore, affected by a privilege escalation vulnerability: - Missing authorization in Ivanti Endpoint Manager Mobile before version...
GHSA-WVM9-9G5J-623F Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange
Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session a...
CVE-2026-36392
FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting XSS. An authenticated administrator can inject arbitrary JavaScript into an item's title, which is stored server-side and executed in the browser of any client user who visits the store page, enabling session hijacking, accou...
CVE-2026-81941 Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user could execute arbitrary operating system commands on the server at the privilege level of the application process by constructing a flow with an MCP Tools component configured to use a local stdio subprocess...
CVE-2026-9327 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
IBM WebSphere Application Server 9.0, and 8.5 could allow an authenticated user with a low-privilege administrative role to modify security configuration. This could result in information disclosure or denial of service...
CVE-2026-9327
IBM WebSphere Application Server versions prior to 9.0.5.29 and 8.5.5.31 are vulnerable to improper privilege management (CWE-269). An authenticated user with a low-privilege administrative role can modify security configuration, potentially leading to information disclosure or denial of service ...
Security Bulletin: IBM MQ Appliance is affected by an improper authorization vulnerability (CVE-2026-10030)
Summary IBM MQ Appliance has addressed an improper authorization vulnerability that could allow an authenticated attacker to create and start queue managers. Vulnerability Details CVEID:CVE-2026-10030 DESCRIPTION: IBM MQ Console allows authenticated non-administrative users to create and start...
CVE-2026-88959
Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any authenticated low-privilege user to create administrator accounts or modify existing ones. Attackers with editor or user roles can POST directly to admin/users/add or...