97184 matches found
CVE-2026-111888
The phpMyFAQ software (versions 4.0.0 before 4.1.9 ) is vulnerable to an incorrect authorization flaw in the news update API. The root cause is that the PUT /admin/api/news/update endpoint incorrectly validates the NEWS_DELETE permission instead of the required NEWS_EDIT right. Consequently, dele...
CVE-2026-111885 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Authorization via deleteGroup API
phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup that omits privilege-level checks on target groups. Authenticated non-SuperAdmin administrators holding GROUPDELETE can send a crafted groupId to /admin/api/group/delete to...
EUVD-2026-103334
phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup that omits privilege-level checks on target groups. Authenticated non-SuperAdmin administrators holding GROUPDELETE can send a crafted groupId to /admin/api/group/delete to...
CVE-2026-111885 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Authorization via deleteGroup API
phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup that omits privilege-level checks on target groups. Authenticated non-SuperAdmin administrators holding GROUPDELETE can send a crafted groupId to /admin/api/group/delete to...
CVE-2026-111884
The phpMyFAQ application versions prior to 4.1.9 and 4.2.0-alpha (before 4.2.0-beta ) are vulnerable to an account takeover flaw. The software fails to require the current password when a user updates their account email via the user control panel (specifically UserController::updateData and api/...
CVE-2026-111884 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account Takeover
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel UserController::updateData, api/user/data/update, checking only the session and CSRF token. An attacker with a hijacked session can set the e-mai...
CVE-2026-111884 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account Takeover
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel UserController::updateData, api/user/data/update, checking only the session and CSRF token. An attacker with a hijacked session can set the e-mai...
EUVD-2026-103335
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel UserController::updateData, api/user/data/update, checking only the session and CSRF token. An attacker with a hijacked session can set the e-mai...
CVE-2026-111884
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel UserController::updateData, api/user/data/update, checking only the session and CSRF token. An attacker with a hijacked session can set the e-mai...
CVE-2026-111884 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account Takeover
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel UserController::updateData, api/user/data/update, checking only the session and CSRF token. An attacker with a hijacked session can set the e-mai...
grafana: grafana: Denial of Service via unbounded request body size in Prometheus rule conversion API
A flaw was found in Grafana. The Prometheus rule conversion API endpoints fail to enforce a limit on request body sizes. An authenticated user can exploit this vulnerability by submitting excessively large requests to trigger unbounded memory allocation, which crashes the server and results in a...
CLSA-2026-1792256009 TuxCare security update for @react-native-community/cli-server-api (1 CVE)
TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 13.6.9-tuxcare.3...
CLSA-2026-1792256007 TuxCare security update for @react-native-community/cli-server-api (1 CVE)
TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 13.6.8-tuxcare.1...
CLSA-2026-1792256008 TuxCare security update for @react-native-community/cli-server-api (1 CVE)
TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 13.5.1-tuxcare.1...
CLSA-2026-1792256005 TuxCare security update for @react-native-community/cli-server-api (1 CVE)
TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 12.0.0-alpha.15-tuxcare.1...
CLSA-2026-1792256004 TuxCare security update for @react-native-community/cli-server-api (1 CVE)
TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 12.0.0-alpha.17-tuxcare.1...
CLSA-2026-1792256003 TuxCare security update for @react-native-community/cli-server-api (1 CVE)
TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 12.3.6-tuxcare.1...
CLSA-2026-1792256002 TuxCare security update for @react-native-community/cli-server-api (1 CVE)
TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 12.3.2-tuxcare.1...