43934 matches found
Exploit for CVE-2026-83991
The File Said No. Cloud Files Said Supersede. CVE-2026-8...
CVE-2026-71807
In RuoYi-Cloud-Plus = 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does not verify whether the current user is the task handler/related user. Authenticated low-privileged remote attackers can read sensitive...
PT-2026-88959
Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerability in the POST /api/admin/builder/markdown/fetch endpoint that allows any authenticated user to fetch arbitrary URLs and read the response body. Attackers can read internal HTTP services and cloud metadata including IA...
CVE-2026-71807
The RuoYi-Cloud-Plus software (version
CVE-2026-71807: Improper Access Control
In RuoYi-Cloud-Plus = 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does not verify whether the current user is the task handler/related user. Authenticated low-privileged remote attackers can read sensitive...
PT-2026-88840
Improper verification of intent by broadcast receiver in Samsung Cloud Assistant prior to version 9.0.5 allows local attackers to disable enhanced data protection settings...
CVE-2026-21106: Improper Verification of Intent by Broadcast Receiver
Improper verification of intent by broadcast receiver in Samsung Cloud Assistant prior to version 9.0.5 allows local attackers to disable enhanced data protection settings...
PT-2026-89164
In RuoYi-Cloud-Plus = 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does not verify whether the current user is the task handler/related user. Authenticated low-privileged remote attackers can read sensitive...
PT-2026-88882
The Enterprise Cloud Database developed by Ragic has an Arbitrary File Read vulnerability. Privileged remote attackers can exploit Relative Path Traversal to download arbitrary system files...
CVE-2026-87747: Relative Path Traversal
The Enterprise Cloud Database developed by Ragic has an Arbitrary File Read vulnerability. Privileged remote attackers can exploit Relative Path Traversal to download arbitrary system files...
Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability
Cisco Secure Firewall Management Center FMC Software and Cisco Security Cloud Control SCC Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on...
CVE-2026-79696: Incomplete List of Disallowed Inputs
A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit ADK for Python versions 2.0.0 through 2.6.0 on Python OSS, Cloud Run, and GKE environments where pytest is installed allows an unauthenticated remote attacker to execute arbitrary code using a crafted test session...
PT-2026-88902
CVE-2026-79696: A Perfect 10.0 in Google's Agent Toolkit Google just shipped a fix for a vulnerability that scored a perfect 10.0 on the CVSS scale — the maximum severity a flaw can get. The bug lives in ADK, Google Cloud's Agent Development Kit for Python — the framework a growing number of team...
CVE-2026-71807
In RuoYi-Cloud-Plus = 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does not verify whether the current user is the task handler/related user. Authenticated low-privileged remote attackers can read sensitive...
openSUSE 16 Security Update : google-cloud-sap-agent (openSUSE-SU-2026:21755-1)
The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21755-1 advisory. This update for google-cloud-sap-agent fixes the following issue: - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers...
Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities
Microsoft has released its monthly security update for September 2026, which includes 973 vulnerabilities affecting a range of products, including 113 that Microsoft marked as "critical." Microsoft notes that 2 of the vulnerabilities disclosed this month have been exploited in the wild:...
com.azure.spring:spring-cloud-azure-actuator-autoconfigure (>=6.0.0-beta.1, <=6.4.0), com.azure.spring:spring-cloud-azure-appconfiguration-config (>=6.0.0, <=6.4.0) +33 more potentially affected by CVE-2026-69854 via com.azure.spring:spring-cloud-azure-autoconfigure (>=6.0.0-beta.1, <=6.4.0)
com.azure.spring:spring-cloud-azure-autoconfigure MAVEN version =6.0.0-beta.1, =6.0.0-beta.1, =6.0.0, =6.0.0, =6.0.0-beta.1, =6.0.0-beta.1, =6.0.0-beta.2, =6.0.0-beta.1, =6.0.0-beta.2, =6.0.0, =6.0.0-beta.2, =6.0.0, =6.0.0, =6.0.0, =6.0.0-beta.2, =6.4.0 -...
com.azure.spring:spring-cloud-azure-actuator-autoconfigure (>=7.0.0-beta.1, <=7.3.0), com.azure.spring:spring-cloud-azure-appconfiguration-config (>=7.0.0-beta.1, <=7.3.0) +33 more potentially affected by CVE-2026-69854 via com.azure.spring:spring-cloud-azure-autoconfigure (>=7.0.0-beta.1, <=7.3.0)
com.azure.spring:spring-cloud-azure-autoconfigure MAVEN version =7.0.0-beta.1, =7.0.0-beta.1, =7.0.0-beta.1, =7.0.0-beta.1, =7.0.0-beta.1, =7.0.0-beta.1, =7.0.0-beta.1, =7.0.0-beta.1, =7.0.0-beta.1, =7.0.0-beta.1, =7.0.0-beta.1, =7.0.0-beta.1, =7.0.0-beta.1, =7.0.0-beta.1, =7.0.0-beta.1, =7.3.0 -...
Improper Authentication
Overview Affected versions of this package are vulnerable to Improper Authentication through the AadOidcIdTokenDecoderFactory and AadB2cOidcIdTokenDecoderFactory OIDC ID token decoders in the Spring Cloud Azure OAuth2 login components. An attacker can elevate privileges and sign in as an...
