CVE-2026-71191

OpenStack Swift (through 2.38.0) is affected by a vulnerability in the S3API middleware where presigned URL requests do not ensure that semantic x-amz-* headers are covered by the SigV4 signature. An attacker with a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, triggering a s...

CVE-2026-55707

In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets from another project's shared network into their own subnetpool, mutating the victim's subnet state and altering L3 routing and address scop...

EUVD-2026-53045

A vulnerability was detected in H3C NX15 V100R017. Affected by this vulnerability is the function esps.wan.repeater.set/repeaterproc of the file /api/esps. Performing a manipulation of the argument my2P4key results in command injection. Remote exploitation of the attack is possible. The exploit i...

CVE-2026-18902

Summary: Affects H3C NX15 V100R017. The vulnerable component is esps.wan.repeater.set/repeaterproc in /api/esps. Manipulating the argument my2P4key enables command injection, enabling remote code execution. The CVSS data indicate high impact with network access, low attack complexity, and no user...

CVE-2026-18902 H3C NX15 esps repeaterproc command injection

A vulnerability was detected in H3C NX15 V100R017. Affected by this vulnerability is the function esps.wan.repeater.set/repeaterproc of the file /api/esps. Performing a manipulation of the argument my2P4key results in command injection. Remote exploitation of the attack is possible. The exploit i...

CVE-2026-18902

A vulnerability was detected in H3C NX15 V100R017. Affected by this vulnerability is the function esps.wan.repeater.set/repeaterproc of the file /api/esps. Performing a manipulation of the argument my2P4key results in command injection. Remote exploitation of the attack is possible. The exploit i...

CVE-2026-8761

The Dokan plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.1. This is due to a missing authorization check in the CustomersController REST controller includes/REST/CustomersController.php, which re-registers WooCommerce's customer CRUD routes...

CVE-2026-18901

A security vulnerability has been detected in H3C NX15 V100R017. Affected is the function service.add of the file /api/esps of the component Web API. Such manipulation leads to exposed dangerous routine. The attack may be launched remotely. The exploit has been disclosed publicly and may be used...

CVE-2026-18901

The CVE-2026-18901 entry concerns H3C NX15 V100R017 Web API. The vulnerable component is the function service.add in the /api/esps endpoint, whose manipulation can expose a dangerous routine. The vulnerability is exploitable remotely, and public exploits/PoCs have been disclosed. References indic...

CVE-2026-18901 H3C NX15 Web API esps service.add routine

A security vulnerability has been detected in H3C NX15 V100R017. Affected is the function service.add of the file /api/esps of the component Web API. Such manipulation leads to exposed dangerous routine. The attack may be launched remotely. The exploit has been disclosed publicly and may be used...

CVE-2026-18900 H3C NX15 Backend RPC esps file.exec os command injection

A weakness has been identified in H3C NX15 V100R017. This impacts the function file.exec of the file /api/esps of the component Backend RPC. This manipulation of the argument File causes os command injection. The attack may be initiated remotely. The exploit has been made available to the public...

[SECURITY] Fedora 43 Update: doctl-1.164.0-1.fc43

The official command line interface for the DigitalOcean API...

CVE-2026-18103

A flaw was found in dhcp-server. A remote attacker with network access to the OMAPI Open Management Application Programming Interface port, especially if not secured with TSIG Transaction Signature key authentication, could send a specially crafted lease creation request. This request, containing...

openjdk: Enhance Jar handling (Oracle CPU 2026-07)

A flaw was found in OpenJDK. There exists a potential existential forgery vulnerability in CMS and protocols which use CMS. In Java, CMS is used to sign JAR files...

CVE-2026-18103 Dhcp-server: dhcp-server: persistent denial of service due to buffer overflow via omapi

A flaw was found in dhcp-server. A remote attacker with network access to the OMAPI Open Management Application Programming Interface port, especially if not secured with TSIG Transaction Signature key authentication, could send a specially crafted lease creation request. This request, containing...

CVE-2026-70590

Ghost is a Node.js content management system. Prior to 6.54.1, any staff-level user was able to leak the hashed passwords of other staff users through the Ghost Admin API. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification...

CVE-2026-18814

A vulnerability was found in H3C NX15 V100R017. This impacts the function reload.reloadconfig of the file /api/esps. The manipulation results in command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this...

Security Bulletin: Multiple Vulnerabilities in IBM API Connect

Summary Multiple vulnerabilities were addressed in IBM API Connect version 10.0.8.11 Vulnerability Details CVEID:CVE-2020-28851 DESCRIPTION: In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension. x/text/language is supposed to...

NPM: Ghost: Blind Password Hash Disclosure in Ghost Admin API

NPM: Ghost: Blind Password Hash Disclosure in Ghost Admin API vulnerability discovered by ? in WordPress Npm ghost versions 6.54.1...

CVE-2026-70590 Ghost: Blind Password Hash Disclosure in Ghost Admin API

Ghost is a Node.js content management system. Prior to 6.54.1, any staff-level user was able to leak the hashed passwords of other staff users through the Ghost Admin API. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification...