170022 matches found
EUVD-2026-104932
Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren't...
EUVD-2026-104919
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest that allows authenticated users to view EEO demographic reports without the canSeeEEOInfo permission. Attackers can invoke the customizeEEOReport and generateEEOReportPreview actions to view aggregat...
CVE-2026-43857
A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with privileges on the service...
CVE-2026-43855
A heap-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution...
CVE-2026-43858
A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution...
CVE-2026-112239
The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its...
CVE-2026-112239 Broken Access Control in extension "TYPO3 AI Integration Extension" (ns_t3ai)
The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its...
EUVD-2026-104864
The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its...
CVE-2026-112239
The TYPO3 AI Integration Extension (ns_t3ai) contains a Broken Access Control vulnerability. The extension provides a backend endpoint that writes submitted values into page records without verifying user permissions or limiting which fields can be modified. Consequently, any authenticated backen...
CVE-2026-113459
The TYPO3 AI Integration Extension (ns_t3ai) running on TYPO3 10 and 11 contains a Sensitive Data Exposure vulnerability. The root cause is that the configured OpenAI API key is embedded in every backend page to allow the editor plugin to contact the service directly from the browser. Consequentl...
CVE-2026-113459 Sensitive Data Exposure in extension "TYPO3 AI Integration Extension" (ns_t3ai)
In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at the expense of the site operator. This only...
CVE-2026-43858
A stack-based buffer overflow vulnerability exists that could allow a remote authenticated attacker to achieve arbitrary code execution . No specific affected products, components, root causes, or remediation details are provided in the documents. Exploitation details are not provided.
CVE-2026-43858
A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution...
EUVD-2026-104859
A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with privileges on the service...
CVE-2026-43857
Technical details regarding the specific software, component, or root cause for CVE-2026-43857 are not publicly available in the provided documents. The description only states that a remote authenticated attacker could achieve arbitrary code execution with service privileges. Monitor for further...
CVE-2026-43857
A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with privileges on the service...
CVE-2026-43846
A stack-based buffer overflow vulnerability in a non-functional feature could allow an authenticated attacker to achieve code execution...
CVE-2026-43855
A heap-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution...
CVE-2026-43855
A heap-based buffer overflow vulnerability exists that could allow a remote authenticated attacker to achieve arbitrary code execution . Specific details regarding the affected product, component, or remediation are not provided in the documents.