11672 matches found
EUVD-2026-56731
Inadequate encryption strength in Windows Active Directory allows an authorized attacker to bypass a security feature over a network...
CVE-2026-73082 Activepieces: Server-side request forgery in MCP tool validation endpoint
Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the POST /api/v1/projects/:projectId/mcp-server/validate-agent-mcp-tool endpoint makes an outbound HTTP or SSE request to a user-supplied serverUrl without URL validation or SSRF protection. An authenticated user can...
CVE-2026-9214
Insufficient input validation vulnerability in the NETGEAR R7000 models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality...
CVE-2026-18640
The NewNotebook API does not sufficiently sanitize its parameters allowing an authenticated user with NOTEBOOKEDIT permission to write the notebook record outside the org's data store directory. The file written must have an extension of ".json.db" but can otherwise overwrite other metadata files...
CVE-2026-11738
Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality...
CVE-2026-11735
A stack-based buffer overflow vulnerability affects the listed NETGEAR models allowing an authenticated admin user to make unauthorized modification to the router's software and functionality...
CVE-2026-11737
Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to the device software and functionality...
CVE-2026-11734
A buffer overflow vulnerability in the listed NETGEAR models allows an authenticated admin user to cause the affected device to become temporarily unavailable...
CVE-2026-53416 Zoom VDI - Path Traversal
Path traversal in Zoom VDI Client and Plugins may allow an authenticated user to conduct information disclosure via local access...
CVE-2026-73079 Sub2API: Path traversal in the Responses subpath routes lets an authenticated tenant relay requests to arbitrary upstream endpoints using pooled account credentials
Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. From 0.1.135, to 0.1.168, platform API keys issued to tenants are exchanged for upstream requests made with shared provider accounts ChatGPT/Codex OAuth, OpenAI platform keys, or an...
CVE-2026-56720
CVE-2026-56720 — CamaleonCMS
CVE-2026-56720 CamaleonCMS 2.9.2 and earlier Missing Authorization via profile Action
CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that allows any authenticated user to access any other user's profile data by supplying an arbitrary user ID parameter. Attackers can send a GET request to the admin profile endpoint...
EUVD-2026-56232
CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that allows any authenticated user to access any other user's profile data by supplying an arbitrary user ID parameter. Attackers can send a GET request to the admin profile endpoint...
GHSA-H784-HPJP-2RRM Duplicate Advisory: Craft CMS: Authenticated RCE through Twig sandbox escape
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f5wm-88jv-g5hx. This link is maintained to preserve external references. Original Description Craft CMS versions = 5.0.0-RC1 before 5.10.7 and = 4.0.0-RC1 before 4.18.3 contain a remote code execution...
CVE-2026-9214 Insufficient input validation in NETGEAR R7000 router allows administrators to tamper with the device.
Insufficient input validation vulnerability in the NETGEAR R7000 models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality...
CVE-2026-9214
The CVE-2026-9214 entry concerns NETGEAR R7000 routers. The root cause is insufficient input validation in the affected device. Affected are authenticated administrators on the local network who can tamper with router software and functionality, leading to unauthorized modifications. No exploitat...
CVE-2026-9214 Insufficient input validation in NETGEAR R7000 router allows administrators to tamper with the device.
Insufficient input validation vulnerability in the NETGEAR R7000 models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality...
EUVD-2026-56196
Insufficient input validation vulnerability in the NETGEAR R7000 models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality...
CVE-2026-11736 Stack-based buffer overflow vulnerability in some NETGEAR Nighthawk routers
A stack-based buffer overflow vulnerability affects certain NETGEAR models allowing an authenticated admin user to make unauthorized modification to router software and functionality...