175032 matches found
GHSA-97FP-2VW9-Q5JG vulnerabilities
Vulnerabilities for packages: libssh...
GHSA-X94W-CG8G-G593 vulnerabilities
Vulnerabilities for packages: libssh...
CVE-2026-59843 vulnerabilities
Vulnerabilities for packages: libssh...
GHSA-4846-7XWG-PW5M vulnerabilities
Vulnerabilities for packages: libssh...
CVE-2026-59851 vulnerabilities
Vulnerabilities for packages: libssh...
CVE-2026-59844 vulnerabilities
Vulnerabilities for packages: libssh...
GHSA-X5CR-V39M-53GW vulnerabilities
Vulnerabilities for packages: libssh...
CVE-2026-59842 vulnerabilities
Vulnerabilities for packages: libssh...
GHSA-CR6P-6527-344M vulnerabilities
Vulnerabilities for packages: libssh...
Insufficient OIDC endpoint validation could invoke unintended local protocol handlers
MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's discovery document. A user induced to connect to an uncontrolled MongoDB deployment using MONGODB-OIDC authentication may have an uncontrolled...
CVE-2026-73303
Budibase is an open-source low-code platform. Prior to 3.40.0, POST /api/v2/email on account.budibase.app accepted a client-controlled accountId without binding it to the authenticated session, while checking only currentEmail. An authenticated attacker who obtains a victim account identifier can...
CVE-2026-73306
Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the failure counter in packages/worker/src/api/controllers/global/auth.ts only for existing users, while packages/worker/src/middleware/emailLockout.ts returned X-Account-Locked and...
CVE-2026-72809
SiYuan versions = v3.7.2 patched in v3.7.4 contain an authentication bypass vulnerability in the kernel's CheckAuth function, which grants the administrator role RoleAdministrator to any request whose RemoteAddr is loopback 127.0.0.1 for a specific set of endpoints including /api/system/exit,...
CVE-2026-72806
SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the FilterViewByPublishAccess filter that fails to check publish password protection when rendering attribute views and database rows. Unauthenticated readers can access password-protected document rows including...
CVE-2026-72786
Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save action that allows authenticated users to change passwords without verification. Attackers with edit users permission can reset any user's password including administrators by exploiting the...
CVE-2026-59914
Dell Display and Peripheral Manager DDPM Windows, versions prior to 2.3.0.17, contain an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges and arbitrary code execution...
CVE-2026-46731
Dell Display and Peripheral Manager DDPM Windows, versions prior to 2.3.0.17, contain an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges and arbitrary code execution...
CVE-2026-18150
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race condition...
CVE-2026-18679
When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection. An on-path actor can intercept the dataplane...