56 matches found
Parse Platform Parse Server input validation error vulnerability
Versions prior to Parse Platform Parse Server 8.6.100 and versions from 9.0.0 through 9.10.4-alpha.3 contain an input validation error vulnerability. This vulnerability arises from the failure to reject writes to reserved internal field names within client objects; as a result, clients can store ...
CVE-2026-111332
OxiCloud versions 0.9.1 through 0.9.3 are vulnerable to an incorrect authorization flaw (CWE-863) involving the share-ring cookie . This vulnerability allows anonymous visitors who already possess an oxi_shares share-ring cookie to maintain access to shared files or folder contents via a GET /api...
CVE-2026-102106
Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not consistently enforce administrator authentication, so the required password check could be bypassed. An attacker who referenced a valid...
EUVD-2026-90313
Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not consistently enforce administrator authentication, so the required password check could be bypassed. An attacker who referenced a valid...
CVE-2026-102106 Kiteworks Email Protection Gateway improper authentication
Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not consistently enforce administrator authentication, so the required password check could be bypassed. An attacker who referenced a valid...
EUVD-2026-89796
sogoyhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any client can supply it arbitrarily and gain access as any user,...
CVE-2026-102106: Improper Authentication
Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not consistently enforce administrator authentication, so the required password check could be bypassed. An attacker who referenced a valid...
PT-2026-103596
Name of the Vulnerable Software and Affected Versions Kiteworks Email Protection Gateway affected versions not specified Description An administrative service in Kiteworks Email Protection Gateway fails to consistently enforce administrator authentication, allowing the password check to be...
CVE-2026-90545 WWBN AVideo Missing Authorization via commentAddNew.json.php
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the commentAddNew.json.php endpoint, allowing authenticated users to post comments on password-protected and group-restricted videos. Attackers can submit POST requests with a valid...
CVE-2026-79576: Improper Authentication
An issue in the Single-Sign On SSO component of Digital-Infrastructure v9.6.7 allows attackers to authenticate as any user, including the Admin, without a password...
CVE-2026-17559: Incorrect Authorization
The Passster WordPress plugin before 4.3.9 does not correctly match its own public endpoint paths when deciding which REST API requests may bypass global password protection, comparing them as an unanchored substring of the request URI rather than against the resolved route, allowing an...
Missing Critical Step in Authentication
Overview org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation. Affected versions of this package are vulnerable to Missing Critical Step in Authentication in the JNDIRealm process when configured to authenticate binds using GSSAPI. An attacker can gain unauthorized access by...
CVE-2026-45282: Improper Access Control
Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authenticated attacker can access attachments of link shares when knowing the share token, circumventing password protection or download...
PT-2026-32031
Name of the Vulnerable Software and Affected Versions ajenti.plugin.core versions prior to 0.112 Description Prior to version 0.112, if two-factor authentication 2FA was enabled, password authentication could be bypassed. This allowed unauthorized access to the system. Recommendations Upgrade to...
EUVD-2000-0147
Malware in sbrugna...
EUVD-2014-3457
Malware in sbrugna...
EUVD-2020-16103
Malware in sbrugna...
EUVD-2019-11660
Malware in sbrugna...