169664 matches found
CVE-2026-67615
The openEQUELLA software prior to version 2026.1.0 is vulnerable to authenticated remote code execution (RCE) via Java deserialization in the HTTP invoker endpoint at /invoker/*. An authenticated non-guest user can bypass the PluginAwareObjectInputStream class-name denylist by nesting a serialize...
CVE-2026-88419
An unrestricted upload of files with a dangerous type in the thumbnail-upload endpoint /index.php?m=member&f=article&v=thumbUpload of WuzhiCMS 5.0.0 allows an authenticated low-privileged member to upload a crafted .php file and execute arbitrary PHP code on the server, because the stored file...
CVE-2026-89282
The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability through its default install directory on C:, which inherits write access for Authenticated Users...
CVE-2026-76714
Vulnerabilities in the Analytics and Location Engine web interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system...
GHSA-89VX-JH4Q-VG3W deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes
Summary The RECORDACTION.PATCHMULTI action is not registered in the Valve permission system's RULESMAP src/services/permission/valve/rules-map.ts. When ConfigPermission.canPerformAction is called for a PATCHMULTI message, getRulesForMessage returns null because the action is missing from the map...
CVE-2026-63104 Kaneo 2.3.12 < 2.12.2 Missing Authorization via Bulk Task Endpoint
Kaneo versions 2.3.12 before 2.12.2 contain a missing authorization vulnerability that allows authenticated workspace members with viewer or member roles to delete and modify tasks beyond their assigned permissions by exploiting the bulk task endpoint that omits workspace permission checks...
CVE-2026-63104 Kaneo 2.3.12 < 2.12.2 Missing Authorization via Bulk Task Endpoint
Kaneo versions 2.3.12 before 2.12.2 contain a missing authorization vulnerability that allows authenticated workspace members with viewer or member roles to delete and modify tasks beyond their assigned permissions by exploiting the bulk task endpoint that omits workspace permission checks...
CVE-2026-89282
The Apache Lounge Windows distribution of the Apache HTTP Server contains an insecure installation directory permissions vulnerability. The issue stems from the default installation directory on **C:**, which incorrectly inherits write access for Authenticated Users . No specific remediation, exp...
CVE-2026-89282 CVE-2026-89282
The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability through its default install directory on C:, which inherits write access for Authenticated Users...
CVE-2026-89282 CVE-2026-89282
The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability through its default install directory on C:, which inherits write access for Authenticated Users...
EUVD-2026-84680
The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability through its default install directory on C:, which inherits write access for Authenticated Users...
CVE-2026-91130
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in src/components/chart/statistics-chart.ts passed entity names through getStatisticLabel and computeStateName and interpolated param.seriesName into ECharts...
EUVD-2026-84674
Vulnerabilities in the Analytics and Location Engine web interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system...
EUVD-2026-84673
A vulnerability exists in the maintenance restore functionality of Analytics and Location Engine ALE. Successful exploitation of this vulnerability could allow an authenticated remote attacker to gain unauthorized access to the file system with root privileges, potentially resulting in full syste...
CVE-2026-76713 Authenticated Remote File System Access Vulnerability in HPE Networking Analytics and Location Engine (ALE)
A vulnerability exists in the maintenance restore functionality of Analytics and Location Engine ALE. Successful exploitation of this vulnerability could allow an authenticated remote attacker to gain unauthorized access to the file system with root privileges, potentially resulting in full syste...
CVE-2026-76713 Authenticated Remote File System Access Vulnerability in HPE Networking Analytics and Location Engine (ALE)
A vulnerability exists in the maintenance restore functionality of Analytics and Location Engine ALE. Successful exploitation of this vulnerability could allow an authenticated remote attacker to gain unauthorized access to the file system with root privileges, potentially resulting in full syste...
CVE-2026-91130 Home Assistant: XSS in Statistics Graph Card
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in src/components/chart/statistics-chart.ts passed entity names through getStatisticLabel and computeStateName and interpolated param.seriesName into ECharts...
CVE-2026-91130
Prior to version 2026.7.0 , the Statistics Graph card in Home Assistant (specifically in src/components/chart/statistics-chart.ts) was vulnerable to Cross-Site Scripting (XSS) . The application failed to escape entity names passed through getStatisticLabel and computeStateName, as well as interpo...
CVE-2026-91130 Home Assistant: XSS in Statistics Graph Card
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in src/components/chart/statistics-chart.ts passed entity names through getStatisticLabel and computeStateName and interpolated param.seriesName into ECharts...
CVE-2026-91130 Home Assistant: XSS in Statistics Graph Card
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in src/components/chart/statistics-chart.ts passed entity names through getStatisticLabel and computeStateName and interpolated param.seriesName into ECharts...