498126 matches found
CVE-2026-19418 TYPO3 CMS - Broken Access Control in Backend and Install Tool
The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 CVE-2020-11069 became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory. Whether a request originated fro...
CVE-2026-19418 TYPO3 CMS - Broken Access Control in Backend and Install Tool
The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 CVE-2020-11069 became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory. Whether a request originated fro...
EUVD-2026-55971
The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 CVE-2020-11069 became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory. Whether a request originated fro...
CVE-2026-19418
The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 CVE-2020-11069 became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory. Whether a request originated fro...
CVE-2026-19418
TYPO3 CMS contains a Broken Access Control in Backend and Install Tool for versions 13.0.0-13.4.33 and 14.0.0-14.3.5. Root cause: referrer enforcement from TYPO3 core SA-2020-006 became ineffective in v13.0+ because the backend/install tooling are served from the site’s main entry script rather t...
CVE-2026-19418 TYPO3 CMS - Broken Access Control in Backend and Install Tool
The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 CVE-2020-11069 became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory. Whether a request originated fro...
CVE-2026-73140
Affected versions of cti-transmute fail to apply comment-level access-control rules when generating evaluation report exports. Although normal comment retrieval filters comments according to conversion visibility, comment privacy, ownership, authorship, and administrative privileges,...
EUVD-2026-55970
Affected versions of cti-transmute fail to apply comment-level access-control rules when generating evaluation report exports. Although normal comment retrieval filters comments according to conversion visibility, comment privacy, ownership, authorship, and administrative privileges,...
CVE-2026-73140
The CVE-2026-73140 issue affects cti-transmute: build_evaluation_report() exported evaluation reports without applying access controls to evaluation comments, allowing a user who can view a conversion to export Markdown/PDF reports containing private comments and the comment author’s name. The ro...
CVE-2026-73140 cti-transmute Evaluation Report Exports Expose Private Comments and Author Information
Affected versions of cti-transmute fail to apply comment-level access-control rules when generating evaluation report exports. Although normal comment retrieval filters comments according to conversion visibility, comment privacy, ownership, authorship, and administrative privileges,...
CVE-2026-73140 cti-transmute Evaluation Report Exports Expose Private Comments and Author Information
Affected versions of cti-transmute fail to apply comment-level access-control rules when generating evaluation report exports. Although normal comment retrieval filters comments according to conversion visibility, comment privacy, ownership, authorship, and administrative privileges,...
CVE-2026-73140 cti-transmute Evaluation Report Exports Expose Private Comments and Author Information
Affected versions of cti-transmute fail to apply comment-level access-control rules when generating evaluation report exports. Although normal comment retrieval filters comments according to conversion visibility, comment privacy, ownership, authorship, and administrative privileges,...
Improper Input Validation
Apache Camel is vulnerable to Improper Input Validation. The vulnerability is due to the Iggy consumer copying externally controlled message headers directly into the Camel Exchange without filtering Camel control headers, which allows an attacker who can publish messages to a consumed Iggy...
tar: Node-tar: Denial of Service via malformed tar archive header
A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop,...
tar: node-tar: Denial of Service via crafted gzip bomb
A flaw was found in node-tar, a tar archive manipulation library for Node.js. This vulnerability allows a remote attacker to craft a small gzip bomb, which, when processed, can lead to the exhaustion of disk space and CPU resources. This occurs because node-tar does not enforce strict limits on t...
brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity
A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the expand function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-lo...
Authorization Bypass
Apache IoTDB is vulnerable to Authorization Bypass. The vulnerability is due to insufficient authorization checks in the /rest/v2/fastLastQuery endpoint, allowing authenticated users to bypass access controls and retrieve last-value query results they are not authorized to access...
CVE-2026-18348
Missing authorization check in the uploadazure, uploadsftp, and uploadsmb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network...
CVE-2026-12052
The USB device-side CDC NCM class control-to-host handler usbdcdcncmcth in subsys/usb/devicenext/class/usbdcdcncm.c builds a fixed-size response for the GETNTBPARAMETERS 28-byte struct ntbparameters and GETNTBINPUTSIZE 8-byte struct ntbinputsize class requests and copies the whole structure into...
CVE-2026-12051
The USB DFU class implementation in Zephyr's new experimental devicenext USB device stack contains a NULL pointer dereference in handledownload subsys/usb/devicenext/class/usbddfu.c. The handler computes MINsetup-wLength, buf-len and passes buf-data to the image write callback without checking th...