46409 matches found
CVE-2026-75851 ArcadeDB before 26.8.1 Authentication Bypass via Async Command
ArcadeDB server com.arcadedb:arcadedb-server in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user,...
CVE-2026-75852
ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials. CVSS 9.8 (Critical)...
CVE-2026-75852 ArcadeDB MongoDB wire protocol authentication bypass cross-database
ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials...
CVE-2026-75851 ArcadeDB before 26.8.1 Authentication Bypass via Async Command
ArcadeDB server com.arcadedb:arcadedb-server in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user,...
CVE-2026-75852 ArcadeDB MongoDB wire protocol authentication bypass cross-database
ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials...
CVE-2026-75843 ArcadeDB before 26.8.1 Privilege Escalation via gRPC Transaction
ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers can execute executeCommand with a transaction ID to run...
CVE-2026-75627
Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrative controllers to read user listings, create manager...
CVE-2026-75627 Bastillion Authentication Bypass via Path-Prefix Routing Mismatch
Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrative controllers to read user listings, create manager...
CVE-2026-75627 Bastillion Authentication Bypass via Path-Prefix Routing Mismatch
Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrative controllers to read user listings, create manager...
EUVD-2026-60578
Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrative controllers to read user listings, create manager...
CVE-2026-75627
Bastillion's controller dispatcher (BaseKontroller.java) fails to validate request URI paths, allowing unauthenticated attackers to bypass authentication filters by prefixing arbitrary path segments. This grants access to administrative controllers to read user listings, create manager accounts, ...
RHSA-2026:55855 Red Hat Security Advisory: libssh security update
Bulletin has no description...
CVE-2026-70429 vulnerabilities
Vulnerabilities for packages: jenkins...
CVE-2026-70426 vulnerabilities
Vulnerabilities for packages: jenkins...
CVE-2026-70430 vulnerabilities
Vulnerabilities for packages: jenkins...
GHSA-C232-R242-W9V9 vulnerabilities
Vulnerabilities for packages: jenkins...
GHSA-V269-8R2R-VJ93 vulnerabilities
Vulnerabilities for packages: jenkins...
Zyxel - Authentication Bypass
An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.32 through 5.20, VPN series firmware versions 4.30 through 5.20, and NSG series firmware...
EyesOfNetwork - Hardcoded API Key & SQL Injection
An issue was discovered in EyesOfNetwork 5.3. The EyesOfNetwork API 2.4.2 is prone to SQL injection, allowing an unauthenticated attacker to perform various tasks such as authentication bypass via the username field to getApiKey in include/apifunctions.php. id: CVE-2020-8656 info: name:...