172758 matches found
CVE-2026-77298
SeaweedFS is a distributed storage system for files and blobs. In versions 4.39 and earlier , the S3 API accepts an external OIDC JWT sent directly in the Authorization header and maps it to an IAM role without enforcing that role's trust policy . While the standard STS AssumeRoleWithWebIdentity ...
CVE-2023-50564
CVE-2023-50564 Come usare Prima imposta un listener per la reverse shell. Terminale 1 root@kitploit: nc -nlvp Esegui lo script che tenterà di installare un modulo pluck inviandoci la reverse shell. Terminale 2 root@kitploit: go run exploit.go -url -password -i -p...
EUVD-2026-66719
LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the Survey Menu Entries administration page. An authenticated user with the global settings:read permission can create a survey menu entry containing attacker-controlled data. The value is stored in the...
CVE-2026-61790
Weblate is a web-based continuous localization platform. In versions prior to 2026.7 , a team can enforce a two-factor authentication (2FA) requirement for its members, but this requirement is not applied to site-wide global permissions — only to project-, component-, and workspace-scoped permiss...
CVE-2026-79938
Dell PowerProtect Cyber Recovery, versions prior to 20.3, contain an Improper Authentication vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...
CVE-2026-75601
Static Web Server (SWS) versions through 2.43.0 contain an authentication bypass when both the basic-auth and metrics features are enabled. The /metrics endpoint is processed before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to retrieve Prometheus metrics ...
CVE-2026-75601 Static Web Server: Authentication bypass on /metrics endpoint when --basic-auth is enabled
Static Web Server SWS is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics features enabled process the /metrics endpoint before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to...
CVE-2026-75601 Static Web Server: Authentication bypass on /metrics endpoint when --basic-auth is enabled
Static Web Server SWS is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics features enabled process the /metrics endpoint before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to...
CVE-2026-79938
Dell PowerProtect Cyber Recovery, versions prior to 20.3, contain an Improper Authentication vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...
EUVD-2026-66707
Dell PowerProtect Cyber Recovery, versions prior to 20.3, contain an Improper Authentication vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...
CVE-2026-79938
Dell PowerProtect Cyber Recovery , versions prior to 20.3 , is affected by an Improper Authentication vulnerability. A low-privileged attacker with remote network access can exploit this flaw to achieve unauthorized access . The CVSS 3.1 score is 7.6 (HIGH) , with the primary impact on integrity ...
CVE-2026-75325
DWSurvey v6.14.0 is is vulnerable to authentication bypass via the '/api/dwsurvey/none/' and '/api/dwsurvey/up/' parameters...
CVE-2026-73501
A flaw was found in kin-openapi. This vulnerability allows a remote attacker to bypass authentication checks. Specifically, the system incorrectly handles missing authentication configurations, substituting them with a function that does not verify user credentials. This enables unauthorized acce...
EUVD-2026-66222
Kimai before 2.53.0 contains an open redirect vulnerability in the SAML authentication success handler that accepts unvalidated RelayState POST parameters as redirect destinations. Attackers with IdP access can supply malicious RelayState values to redirect authenticated users to...
CVE-2026-47837
Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated. This issue affects Spring Cloud Config: from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2....
EUVD-2026-66638
Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated. This issue affects Spring Cloud Config: from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2....
CVE-2026-47837
Spring Cloud Config is affected by a Missing Authentication for Critical Function vulnerability in the Server's /monitor endpoint. Webhook requests sent to this endpoint are not properly validated, meaning an authenticated user (Privileges Required: HIGH ) can send crafted webhook requests that c...
CVE-2026-47837 Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests
Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated. This issue affects Spring Cloud Config: from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2....
CVE-2026-16599
A flaw was found in wget's FTP OPIE/S-KEY authentication functionality. A malicious FTP server or a network attacker can send a specially crafted OPIE challenge. This challenge contains a sequence number that, when processed by wget, can lead to an excessive number of cryptographic computations...
CVE-2026-81032
NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service. Each daemon starts the web service defined in src/webservice/WebService.cpp, whose bind address defaults to all interfaces, and registers routes for reading and writing gflags alongside status and statistics...