170022 matches found
CVE-2026-28329
SolarWinds Observability Self-Hosted is affected by a Server-Side Request Forgery (SSRF) vulnerability. This flaw allows authenticated attackers to force the application server to transmit requests to attacker-controlled or internal destinations . The vulnerability is associated with CWE-918 and ...
CVE-2026-113599
Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to create auto-reply messages for arbitrary mailboxes by supplying another user's mbox value. Attackers can POST to /api/v2/armessages/ to inject attacker-controlled auto-reply subject...
CVE-2026-113598
Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete alarms of other domains via the POST /api/v2/alarms/bulkdelete/ action. Attackers can enumerate sequential alarm IDs to delete DNS, MX and blocklist monitoring alarms...
CVE-2026-107755
Insufficient filtering of credentials in the replicator database in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to read replication credentials of other users’ replications, not just their own. Users are recommended to upgrade to version 3.5.3, which fixes this...
EUVD-2026-105174
A flaw has been found in aaPanel up to 8.25.0. Impacted is the function sendfile of the file BTPanel/routes/v2.py of the component Download Endpoint. Executing a manipulation of the argument filename can lead to path traversal. The attack can be executed remotely. The exploit has been published a...
CVE-2026-112955
The ApostropheCMS Node.js content management system is vulnerable to a denial-of-service (DoS) condition in the import-export module prior to version 3.7.1 . An authenticated importer can submit archives with unbounded decompressed bytes, entry counts, and entry sizes. Because these values are no...
CVE-2026-112955 ApostropheCMS: Import archives can exhaust server storage and deny service
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authenticated importer can submit archives whose decompressed bytes, entry count, and entry sizes are not bounded before document-type authorization, and extraction or parsing failure...
CVE-2026-112952 ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, 'POST /api/v1/@apostrophecms/doc/slugTaken' with body "slug": "target-slug" returns a boolean indicating whether a slug is in use across all document types and visibility levels, with no permission or type filter...
CVE-2026-112952
ApostropheCMS , an open-source Node.js content management system, contains a vulnerability prior to version 4.34.0 where the POST /api/v1/@apostrophecms/doc/slugTaken endpoint lacks proper permission or type filters. This allows any authenticated user, including those with lower privileges like e...
CVE-2026-112952 ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, 'POST /api/v1/@apostrophecms/doc/slugTaken' with body "slug": "target-slug" returns a boolean indicating whether a slug is in use across all document types and visibility levels, with no permission or type filter...
CVE-2026-112952 ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, 'POST /api/v1/@apostrophecms/doc/slugTaken' with body "slug": "target-slug" returns a boolean indicating whether a slug is in use across all document types and visibility levels, with no permission or type filter...
CVE-2026-113599 Modoboa before 2.8.0 IDOR via API v2 armessages Auto-Reply Creation
Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to create auto-reply messages for arbitrary mailboxes by supplying another user's mbox value. Attackers can POST to /api/v2/armessages/ to inject attacker-controlled auto-reply subject...
CVE-2026-113599
Modoboa versions before 2.8.0 are vulnerable to an Insecure Direct Object Reference (IDOR) flaw in the API v2 armessages endpoint. This vulnerability allows authenticated users to create auto-reply messages for arbitrary mailboxes by providing another user's mbox value . An attacker can perform a...
CVE-2026-113599 Modoboa before 2.8.0 IDOR via API v2 armessages Auto-Reply Creation
Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to create auto-reply messages for arbitrary mailboxes by supplying another user's mbox value. Attackers can POST to /api/v2/armessages/ to inject attacker-controlled auto-reply subject...
EUVD-2026-105164
Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete alarms of other domains via the POST /api/v2/alarms/bulkdelete/ action. Attackers can enumerate sequential alarm IDs to delete DNS, MX and blocklist monitoring alarms...
CVE-2026-113583
Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by crafting malicious alt text or URL values in an HTML email's external image tag when ALLOWEXTERNALIMAGESOURCES is enabled. Attackers can send ...
EUVD-2026-104966
Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by crafting malicious alt text or URL values in an HTML email's external image tag when ALLOWEXTERNALIMAGESOURCES is enabled. Attackers can send ...
CVE-2026-113583 Cypht 2.0.0 through 2.12.2 Stored DOM XSS via externalResources.js
Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by crafting malicious alt text or URL values in an HTML email's external image tag when ALLOWEXTERNALIMAGESOURCES is enabled. Attackers can send ...
CVE-2026-9589
Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren't...
CVE-2026-112787
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest that allows authenticated users to view EEO demographic reports without the canSeeEEOInfo permission. Attackers can invoke the customizeEEOReport and generateEEOReportPreview actions to view aggregat...