160359 matches found
CVE-2026-111641
FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange i...
EUVD-2026-103063
FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange i...
CVE-2026-111641
FastapiAdmin versions through 3.0 are vulnerable to an authentication bypass due to unprotected auto-login endpoints. An unauthenticated attacker can exploit this by listing users via /api/v1/auth/auto-login/users, minting a superuser auto-login token , and exchanging it for a JWT session . This ...
CVE-2026-111641 FastapiAdmin through 3.0 Authentication Bypass via Auto-Login Endpoints
FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange i...
CVE-2026-111641 FastapiAdmin through 3.0 Authentication Bypass via Auto-Login Endpoints
FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange i...
PT-2026-116040
Name of the Vulnerable Software and Affected Versions FastapiAdmin versions prior to 3.1 Description An authentication bypass allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via the...
GHSA-JRQ7-XRJX-PCFW Nginx UI: Auto backup name allows path traversal outside validated storage path
Summary Nginx UI validates backuppath and storagepath against the administrator-defined backup.GrantedAccessPath boundary, but the final auto-backup output filename is built from the user-controlled auto-backup name without stripping path separators or .. components. An authenticated user who can...
Nginx UI: Auto backup name allows path traversal outside validated storage path
Summary Nginx UI validates backuppath and storagepath against the administrator-defined backup.GrantedAccessPath boundary, but the final auto-backup output filename is built from the user-controlled auto-backup name without stripping path separators or .. components. An authenticated user who can...
Astra Linux – Vulnerability in Linux
A race condition in Linux kernel SCTP sockets net/sctp/socket.c before version 5.12-rc8 can lead to kernel privilege escalation from the context of a network service or an unprivileged process. If the sctpdestroysock function is called without using the socknetsk-sctp.addrwqlock lock, an element...
auto-qchem (>=0.1.1, <=1.2.6), crsmongo (>=1.0.0, <=1.0.6) +5 more potentially affected by CVE-2026-96749 via pymongo (3.10.0)
pymongo PYPI version 3.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - auto-qchem =0.1.1, =1.0.0, =0.1.24, =0.0.1, =0.1.0, =0.1.10, =2.0.7, =2.3.2 Source cves: CVE-2026-96749 Source advisory: OSV:PYSEC-2026-4296...
auto-qchem (>=0.1.1, <=1.2.6), crsmongo (>=1.0.0, <=1.0.6) +5 more potentially affected by CVE-2026-88029 via pymongo (3.10.0)
pymongo PYPI version 3.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - auto-qchem =0.1.1, =1.0.0, =0.1.24, =0.0.1, =0.1.0, =0.1.10, =2.0.7, =2.3.2 Source cves: CVE-2026-88029 Source advisory: OSV:PYSEC-2026-4294...
CVE-2026-108092 Social Media Auto Post & Scheduler <= 9.1.4 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure
The Blog2Social – Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 9.1.4. This is due to the b2sshipitem and b2sshipitemreloadurl AJAX handlers lacking per-object authorization on the postId parameter...
CVE-2026-108092
The Blog2Social – Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in all versions up to and including 9.1.4 . The root cause is that the b2s_ship_item and b2s_ship_item_reload_url AJAX handlers fail to implement per-object author...
CVE-2026-102028
A NULL Pointer Dereference vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows a remote BGP peer to cause a denial of service when multiple UPDATEs occur over a single TCP session with 'bgp family l2vpn auto-discovery-only' configured...
CVE-2026-102017
An Out-of-bounds Write vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker to cause a routing-plane denial of service via Auto-RP mapping announcements received when Auto-RP mapping is enabled...
EUVD-2026-101353
A NULL Pointer Dereference vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows a remote BGP peer to cause a denial of service when multiple UPDATEs occur over a single TCP session with 'bgp family l2vpn auto-discovery-only' configured...
CVE-2026-102028 Junos OS and Junos OS Evolved: An attacker causes an rpd crash when VPLS auto-discovery is used
A NULL Pointer Dereference vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows a remote BGP peer to cause a denial of service when multiple UPDATEs occur over a single TCP session with 'bgp family l2vpn auto-discovery-only' configured...
CVE-2026-102017 Junos OS and Junos OS Evolved: An attacker causes routing-plane denial of service when Auto-RP mapping is enabled
An Out-of-bounds Write vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker to cause a routing-plane denial of service via Auto-RP mapping announcements received when Auto-RP mapping is enabled...
EUVD-2026-101338
An Out-of-bounds Write vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker to cause a routing-plane denial of service via Auto-RP mapping announcements received when Auto-RP mapping is enabled...
CVE-2026-102017
An Out-of-bounds Write vulnerability exists in the rpd process of Juniper Networks Junos OS and Junos OS Evolved . This flaw allows an unauthenticated attacker to trigger a routing-plane denial of service by sending Auto-RP mapping announcements when Auto-RP mapping is enabled. No specific exploi...