37372 matches found
EUVD-2026-70585
Unauthenticated Settings Change in WP Compress = 7.21.28 versions...
EUVD-2026-70530
ColdFusion is affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain limited read and write access. The vulnerable component is restricted to an administrative network zone by default. Exploitation of...
CVE-2026-85182
vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change arbitrary account passwords by supplying a target account ID and that account's current password in the request body...
CVE-2026-85182 vhr Missing Authorization in PUT /hr/pass Allows Cross-Account Password Change
vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change arbitrary account passwords by supplying a target account ID and that account's current password in the request body...
CVE-2026-85182
vhr (a Java-based HR management system) through commit 03abbd3 contains a missing authorization flaw in the PUT /hr/pass endpoint. The server fails to verify that the account ID supplied in the request belongs to the authenticated caller, enabling cross-account password changes : any authenticate...
CVE-2026-85182 vhr Missing Authorization in PUT /hr/pass Allows Cross-Account Password Change
vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change arbitrary account passwords by supplying a target account ID and that account's current password in the request body...
EUVD-2026-70486
vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change arbitrary account passwords by supplying a target account ID and that account's current password in the request body...
CVE-2026-78002
creationtimestamp| type| source ---|---|--- 2026-09-03 13:35:41+00:00| seen| https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mumkx6urax2z 2026-09-03 15:07:55+00:00| seen| https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mumq447ubq24...
CVE-2026-80254
Authorization bypass through user-controlled key issue exists in ShizenBox2 edge-app. If exploited, an attacker who can log in to the product may change the other user's password...
EUVD-2026-70389
WWBN AVideo contains an authentication failure vulnerability where the videoidhash credential is a non-expiring, non-revocable bearer token that grants full administrator session access to the video owner's account. Attackers who obtain a videoidhash can replay it indefinitely to authenticate as...
CVE-2026-80254
ShizenBox2 (edge-app) , a product by se-digital.net, is affected by an authorization bypass caused by a user-controlled key issue. An attacker with valid credentials can exploit this to change another user's password , resulting in a high integrity impact (CVSS v3.0: 6.5 MEDIUM , CVSS v4.0: 7.1 H...
CVE-2026-80254
Authorization bypass through user-controlled key issue exists in ShizenBox2 edge-app. If exploited, an attacker who can log in to the product may change the other user's password...
EUVD-2026-70366
Authorization bypass through user-controlled key issue exists in ShizenBox2 edge-app. If exploited, an attacker who can log in to the product may change the other user's password...
CVE-2026-80254
Authorization bypass through user-controlled key issue exists in ShizenBox2 edge-app. If exploited, an attacker who can log in to the product may change the other user's password...
CVE-2026-85182: Authorization Bypass Through User-Controlled Key
vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change arbitrary account passwords by supplying a target account ID and that account's current password in the request body...
PT-2026-85041
vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change arbitrary account passwords by supplying a target account ID and that account's current password in the request body...
CVE-2026-84757: Missing Authorization
Unauthenticated Settings Change in WP Compress = 7.21.28 versions...
PT-2026-84972
Authorization bypass through user-controlled key issue exists in ShizenBox2 edge-app. If exploited, an attacker who can log in to the product may change the other user's password...
CVE-2026-80254: Authorization Bypass Through User-Controlled Key
Authorization bypass through user-controlled key issue exists in ShizenBox2 edge-app. If exploited, an attacker who can log in to the product may change the other user's password...