129002 matches found
CVE-2026-59689
An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with low privileges to escalate privileges to root on the affected appliance, potentially resulting in full system...
EUVD-2026-49186
An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the backup restore...
CVE-2026-59688
An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the backup restore...
EUVD-2026-49185
An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the Geo Location...
EUVD-2026-49184
An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the management interfac...
CVE-2026-59686
An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the management interfac...
CVE-2026-64437
A flaw was found in the ksmbd component of the Linux kernel. This vulnerability allows an authenticated client using the Server Message Block SMB protocol to trigger a use-after-free error. By sending specific close and cancel requests, an attacker can cause the kernel to crash, leading to a deni...
CVE-2026-64398
A flaw was found in the Linux kernel's ksmbd component. An authenticated Server Message Block SMB client with only FILEWRITEATTRIBUTES permission can bypass a security check in the FSCTLSETZERODATA function. This allows the client to zero out file data, leading to data destruction and a denial of...
EUVD-2026-49063
Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assigned to by supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint. Attackers can enumerate integer milesto...
CVE-2026-66412 Leantime all versions prior to and 3.6.2 Broken Access Control via tickets.getMilestone JSON-RPC
Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assigned to by supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint. Attackers can enumerate integer milesto...
PT-2026-64902
Name of the Vulnerable Software and Affected Versions Progress Software LoadMaster affected versions not specified Progress Software ECS Connection Manager affected versions not specified Progress Software Object Scale Connection Manager affected versions not specified Progress Software MOVEit WA...
PT-2026-65115
An authenticated privilege-escalation vulnerability in JFrog Platform may be exploited under admin-provisioned account conditions. Successful exploitation may grant temporary platform administrator access...
Oracle Database Server (July 2026 CPU)
The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.31 and 23.4.0-23.26.2. Easil...
Linux Distros Unpatched Vulnerability : CVE-2026-13055
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The $internalIndexKey aggregation expression can be used by any authenticated user to crash a MongoDB server mongod. The expression fails to handle compound...
PT-2026-65081
Name of the Vulnerable Software and Affected Versions Devolutions Server versions 2026.2.4.0 through 2026.2.12.0 Devolutions Server versions 2026.1.23.0 and earlier Description Improper access control in the NetBox synchronizer allows an authenticated user with view-only permission on an entry to...
Linux Distros Unpatched Vulnerability : CVE-2026-13077
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of- bounds heap read via a crafted aggregation pipeline. Th...
PT-2026-65090
Name of the Vulnerable Software and Affected Versions Ekushey Project Manager CRM versions prior to 5.1 Description A stored cross-site scripting issue exists where authenticated client users can inject arbitrary HTML and JavaScript. This occurs when malicious payloads are entered into the Name...
Linux Distros Unpatched Vulnerability : CVE-2026-13063
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted...
Linux Distros Unpatched Vulnerability : CVE-2026-13062
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are...
PT-2026-65095
Name of the Vulnerable Software and Affected Versions Ekushey Project Manager CRM versions prior to 5.1 Description A stored cross-site scripting issue exists where authenticated client users can inject arbitrary HTML and JavaScript. This occurs when malicious payloads are entered into the Reply...