CVE-2023-23752

CVE-2023-23752 Joomla Unauthorized Access Vulnerability fofa: product="Joomla" Usage usage: CVE-2023-23752.py -h -u URL -f FILE -t THREAD -T TIMEOUT -o OUTPUT optional arguments: -h, --help show this help message and exit -u URL, --url URL Target urle.g. url.txt -f FILE, --file FILE Target filee....

CVE-2026-12352

CVE-2026-12352 Summary An unauthenticated, load-induced authentication bypass was identified in the Digi PortServer TS 4 H MEI, allowing retrieval of a local device configuration file without valid credentials. Under increased concurrent request load, the web server begins serving file contents...

EUVD-2026-102116

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the safe-delete path reached through ApiMutableModelControllerBase::delBase interpolates an unvalidated safe-delete token from the request URL into an XPath expression over config.xml before confirming that the...

CVE-2026-58395

OPNsense versions prior to 26.1.11 are vulnerable to an XPath injection vulnerability in the ApiMutableModelControllerBase::delBase() safe-delete path. The flaw occurs because an unvalidated safe-delete token from the request URL is interpolated into an XPath expression against config.xml before ...

CVE-2026-109575

In HAProxy Data Plane API 2.2.0 through 3.4.3 and corresponding Enterprise Edition releases, Server.ConfigureAPI has process-global authentication logic that improperly drops security controls across multiple transport types. When a TLS Certificate Authority tlsca is configured and a numeric TLS...

CVE-2026-78356

The OTRS application is vulnerable to an unauthenticated disclosure of the Agent Frontend configuration. This flaw allows remote users to access an endpoint without authentication, retrieving internal details such as frontend routes , authorization groups , authentication configurations , enabled...

CVE-2026-100668

Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape. The "array" filter and its identical function form is on the sandbox allowlist but is registered without the needsissandboxed guard that printr, vardump, jsonencode, yamlencode and string carry, and its implementation calls toArray ...

CVE-2026-100668 Grav before 2.0.25 Sandbox Escape via array Filter

Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape. The array filter and its identical function form is on the sandbox allowlist but is registered without the needsissandboxed guard that printr, vardump, jsonencode, yamlencode and string carry, and its implementation calls toArray — ...

CVE-2026-89004 WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Campaign Configuration and Log Disclosure via IDOR

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not verify ownership or authorization before returning a campaign's stored configuration and run log, allowing users with contributor-level access and above to read the configuration and execution logs of campaigns created by othe...

CVE-2026-89004

The WPeMatico RSS Feed Fetcher WordPress plugin, in versions before 2.8.26 , is vulnerable to an Insecure Direct Object Reference (IDOR) . The flaw exists because the plugin fails to verify ownership or authorization before returning a campaign's stored configuration and run logs. Consequently, u...

WordPress WPeMatico RSS Feed Fetcher plugin < 2.8.26 - Contributor+ Campaign Configuration and Log Disclosure vulnerability

Contributor+ Campaign Configuration and Log Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin WPeMatico RSS Feed Fetcher versions 2.8.26...

CVE-2026-92929: Authentication Bypass by Spoofing

OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 trusts an X-Forwarded-For header supplied by an arbitrary client when determining the request source address. An unauthenticated remote attacker can spoof a loopback address to bypass local-connection-only security controls exposed on the...

GHSA-8XCJ-9HFR-FH9J Unleash: Clone-feature lets a user copy a feature from a project they cannot read

Summary The clone-feature endpoint supports copying features across projects, but it does not verify that the caller can access the source project. A user with create permissions in one project can clone a feature from another project they cannot read and then inspect the copied configuration. Th...

CVE-2026-52742 GoCD is vulnerable to historical server configuration API authorization bypass

GoCD is a continuous deliver server. From 12.3.1 until 26.1.0, legacy routes under /go/admin/restful/ expose historical full server configuration to pipeline group administrators instead of restricting responses to configuration for groups they administer. The disclosed configuration can include...

CVE-2026-52742 GoCD is vulnerable to historical server configuration API authorization bypass

GoCD is a continuous deliver server. From 12.3.1 until 26.1.0, legacy routes under /go/admin/restful/ expose historical full server configuration to pipeline group administrators instead of restricting responses to configuration for groups they administer. The disclosed configuration can include...

CVE-2026-52742: Incorrect Authorization

GoCD is a continuous deliver server. From 12.3.1 until 26.1.0, legacy routes under /go/admin/restful/ expose historical full server configuration to pipeline group administrators instead of restricting responses to configuration for groups they administer. The disclosed configuration can include...

EUVD-2026-57010

Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 /env, /loggers bypass API basic-auth...

CVE-2026-92917 Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_r

Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters printr, vardump, jsonencode, yamlencode, string: GravExtension::assertSandboxDumpSafe determines sandbox state by calling SandboxExtension::isSandboxed without...

CVE-2026-92917 Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_r

Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters printr, vardump, jsonencode, yamlencode, string: GravExtension::assertSandboxDumpSafe determines sandbox state by calling SandboxExtension::isSandboxed without...

CVE-2026-92917 Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_r

Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters printr, vardump, jsonencode, yamlencode, string: GravExtension::assertSandboxDumpSafe determines sandbox state by calling SandboxExtension::isSandboxed without...