173907 matches found
CVE-2026-59825 Mastodon: Unwanted deactivation of SSL/TLS certificate verification
Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldapauthenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULTPARAMS when LDAP authentication uses LDAPTLSNOVERIFY=true, disabling SSL and T...
EUVD-2026-60953
Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldapauthenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULTPARAMS when LDAP authentication uses LDAPTLSNOVERIFY=true, disabling SSL and T...
CVE-2026-59825
When LDAP auth uses LDAP_TLS_NO_VERIFY=true, app/models/concerns/user/ldap_authenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULT_PARAMS, disabling SSL/TLS verification globally for puma web processes. This enables MITM attacks against all puma-originated HTTPS requests. Fixed in Mastodon 4.4...
CVE-2026-59825 Mastodon: Unwanted deactivation of SSL/TLS certificate verification
Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldapauthenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULTPARAMS when LDAP authentication uses LDAPTLSNOVERIFY=true, disabling SSL and T...
CVE-2026-69189
Hoppscotch versions prior to 2026.6.0 contain an IDOR vulnerability in team and UserHistory GraphQL resolvers: authenticated workspace members can read other users' private request history, authorization headers, session data, and environment values, and modify or delete victim history entries. F...
EUVD-2026-60948
goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when goshs is launched with WebDAV enabled -w, the mode-restriction flags --read-only, --upload-only, and --no-delete are enforced only on the primary HTTP port. The WebDAV port is wired straight to golang.org/x/net/webdav.Handler...
CVE-2026-50138 goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags
goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when goshs is launched with WebDAV enabled -w, the mode-restriction flags --read-only, --upload-only, and --no-delete are enforced only on the primary HTTP port. The WebDAV port is wired straight to golang.org/x/net/webdav.Handler...
CVE-2026-50575
BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are...
CVE-2026-43871 affecting package influxdb for versions less than 2.7.5-20
CVE-2026-43871 affecting package influxdb for versions less than 2.7.5-20. A patched version of the package is available...
CVE-2026-73995 WordPress User Registration plugin <= 5.2.6 - Broken Authentication vulnerability
Subscriber Broken Authentication in User Registration = 5.2.6 versions...
EUVD-2026-60809
Subscriber Broken Authentication in User Registration = 5.2.6 versions...
CVE-2026-73995
The WordPress User Registration plugin (versions ≤ 5.2.6) has a broken authentication flaw allowing subscribers to bypass access controls; CVSS 5.4 (MEDIUM). CISA SSVC reports no active exploitation. No exploit code is provided; upgrade beyond 5.2.6 to remediate. Details via Patchstack reference.
EUVD-2026-60805
Unauthenticated Broken Authentication in Flutterwave WooCommerce = 3.3.0 versions...
CVE-2026-73398
Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions...
CVE-2026-73399
Unauthenticated Broken Authentication in Flutterwave WooCommerce = 3.3.0 versions...
CVE-2026-73399
The rave-woocommerce-payment-gateway plugin (versions ≤ 3.3.0) has an unauthenticated broken authentication flaw allowing remote attackers to bypass login, rated CVSS 6.5 (Medium). No exploitation evidence is provided; update to a newer plugin version when available. Reference: https://patchstack...
CVE-2026-73399 WordPress Flutterwave WooCommerce plugin <= 3.3.0 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in Flutterwave WooCommerce = 3.3.0 versions...
CVE-2026-73398 WordPress Piraeus Bank WooCommerce Payment Gateway plugin 3.2.0 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions...
CVE-2026-73398
The WordPress Piraeus Bank WooCommerce Payment Gateway plugin 3.2.0 has a broken authentication flaw exploitable by unauthenticated remote attackers, allowing unauthorized actions with low integrity and availability impact. CVSS 6.5 (Medium). Patchstack advisory linked; no exploit code or specifi...