97022 matches found
PT-2026-116477
phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Attackers can lure a logged-in user with the CONFIGURATION EDIT permission into submitting a crafted...
PT-2026-116479
phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser API that allows authenticated non-superadmin users with delete user permission to delete superadmin accounts. Attackers can send a DELETE request to /admin/api/user/delete with a superadmin's userId other than ...
PT-2026-116464
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a privilege escalation vulnerability in GroupController::saveCategoryRestrictions that lets delegated administrators assign categories outside their own scope. Category-restricted administrators can POST to /admin/api/group/category-restrictions wit...
PT-2026-116475
Name of the Vulnerable Software and Affected Versions phpMyFAQ versions 3.2.0 through 4.1.8 phpMyFAQ versions 4.2.0-alpha through 4.2.0-alpha Description An insecure direct object reference exists in the 'GET /admin/api/user/data/userId' endpoint. The system returns the complete faquserdata row f...
PT-2026-127116
TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 15.1.3-tuxcare.1...
PT-2026-127114
TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 12.3.7-tuxcare.1...
PT-2026-127125
TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 13.6.8-tuxcare.1...
CVE-2026-111893: Improper Privilege Management
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a privilege escalation vulnerability in GroupController::saveCategoryRestrictions that lets delegated administrators assign categories outside their own scope. Category-restricted administrators can POST to /admin/api/group/category-restrictions wit...
CVE-2026-111904: Exposure of Sensitive Information to an Unauthorized Actor
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an information disclosure vulnerability that allows unauthenticated attackers to read hidden open questions due to an inverted api.onlyPublicQuestions check in OpenQuestionController. Attackers can send GET requests to the /api/v4.0/open-questions...
CVE-2026-111906: Cross-Site Request Forgery (CSRF)
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSearch administration API endpoints, which do not validate a CSRF token for the create, drop, and import actions. Attackers can lure a user with CONFIGURATIONED...
CVE-2026-111907: Cross-Site Request Forgery (CSRF)
phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Attackers can lure a logged-in user with the CONFIGURATIONEDIT permission into submitting a crafted...
PT-2026-127120
TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 5.0.1-tuxcare.1...
PT-2026-127122
TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 12.3.6-tuxcare.1...
PT-2026-127117
TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 15.1.3-tuxcare.2...
CVE-2026-111928: Incorrect Authorization
Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the aclallow rule of coderd/rbac/policy.rego, which does not verify organization membership for per-user ACL entries, and organization member removal does not scrub those entries. Authenticated users removed from ...
PT-2026-116496
Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the acl allow rule of coderd/rbac/policy.rego, which does not verify organization membership for per-user ACL entries, and organization member removal does not scrub those entries. Authenticated users removed from...
CVE-2026-111927: Insufficiently Protected Credentials
Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trust...
PT-2026-127126
TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 13.5.1-tuxcare.1...
Linux Distros Unpatched Vulnerability : CVE-2026-85529
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain...