173226 matches found
EUVD-2026-63799
Missing authentication for critical function vulnerability exists in VOCALOID6. Any process running under the same local user account as a running VOCALOID6 Editor instance may escalate privileges via a local named pipe...
CVE-2026-76137
Missing authentication for critical function vulnerability exists in VOCALOID6. Any process running under the same local user account as a running VOCALOID6 Editor instance may escalate privileges via a local named pipe...
CVE-2026-76137
VOCALOID6 Editor exposes a local named pipe without authentication; any process on the same local user account can send commands and escalate privileges. CVSS 3.3/4.8 reflects low-to-medium local-only impact; no exploit code or in-the-wild activity is documented. Users should update via the offic...
CVE-2026-76131
Hard-coded credentials in VOCALOID6 Editor allow network-based impersonation of the legitimate client, enabling unauthorized access to Yamaha's activation and content servers. CVSS 3.1 scores this MEDIUM (5.3). No exploit code or in-the-wild exploitation is documented; monitor Yamaha and JPCERT a...
EUVD-2026-63792
Missing authentication for a critical function in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an unauthenticated remote attacker to upload arbitrary files to the server's configured upload directory...
CVE-2026-76157
Datiphy Data Management Center v8.3.0 through v8.5.1 has an unauthenticated upload API endpoint allowing remote attackers to upload arbitrary files, scoring CVSS 8.8 (HIGH) for integrity and availability impact. No exploitation evidence or patch details are provided; monitor the advisory at https...
CVE-2026-76157 Datiphy Data Management Center - Missing Authentication for Critical Function
Missing authentication for a critical function in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an unauthenticated remote attacker to upload arbitrary files to the server's configured upload directory...
CVE-2026-76155 Datiphy Data Management Center - Use of Default Credentials
Use of default credentials in Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to gain administrative access to the management platform by logging in with default administrator credentials...
EUVD-2026-63795
Use of default credentials in Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to gain administrative access to the management platform by logging in with default administrator credentials...
EUVD-2026-63775
Improper input validation and Exposure of sensitive information through data queries vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, and Genians Genian ZTNA V6.0 allows SQL Injection and Authentication Bypass. This issue affects Genian NAC V4.0: from 4.0.0 before 4.0.175Revisio...
EUVD-2026-63716
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper authentication...
EUVD-2026-63634
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper authentication...
EUVD-2026-63701
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information due to improper authentication...
CVE-2026-16520
Improper input validation and Exposure of sensitive information through data queries vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, and Genians Genian ZTNA V6.0 allows SQL Injection and Authentication Bypass. This issue affects Genian NAC V4.0: from 4.0.0 before 4.0.175Revisio...
PT-2026-79398
Jet Admin allows an attacker to create a malicious app and connect it to a target user's custom domain, edit the authentication configuration, and reroute traffic to the attacker-controlled app. Once connected to the target domain, the attacker's workspace is populated with the victim's OAuth...
PT-2026-79499
Name of the Vulnerable Software and Affected Versions Arc Enterprise versions prior to 26.06.1 Description The cluster replication receiver at internal/cluster/replication/receiver.go validates only the wire-format envelope of inbound messages. The MsgReplicateSync payload is accepted without...
PT-2026-79312
Name of the Vulnerable Software and Affected Versions Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress versions prior to 4.8.7 Description An authentication bypass exists because the handle email otp return function returns a secret magic...
Zabbix Server 7.4.x < 7.4.11 Authentication Bypass (ZBX-28071)
The version of Zabbix Server installed on the remote host is 7.4.x prior to 7.4.11. It is, therefore, affected by an authentication bypass vulnerability: - The cryptographic key used for signing Frontend sessions has been erroneously written to the database seed. In deployments that utilize both...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099440)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099440 advisory. Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. Th...