67814 matches found
CVE-2026-90905
Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 - The endpoint administrator/index.php?option=comeasystore&task=appconfig.updateConfiguration updated core Joomla mail configuration fromname, mailfrom in...
Klever-Go: /log controls global node logging
An unauthenticated client can connect to GET /log, send an arbitrary logger profile as the first WebSocket message, and mutate the node's global logging configuration before receiving live logs from the process. I confirmed this against a local validator built from this repository: an...
GHSA-9V8P-FRVJ-2PCM Klever-Go: /log controls global node logging
An unauthenticated client can connect to GET /log, send an arbitrary logger profile as the first WebSocket message, and mutate the node's global logging configuration before receiving live logs from the process. I confirmed this against a local validator built from this repository: an...
CVE-2026-84709
A flaw was found in Red Hat Ansible Automation Platform's automation-controller. When a custom credential type is created or updated, the injector configuration is validated by rendering each attacker-supplied Jinja2 template synchronously inside the web request worker, with no limit on iteration...
Improper Validation of Array Index
Overview Affected versions of this package are vulnerable to Improper Validation of Array Index via the pcmmulti process. An attacker can cause the application to abort by supplying a crafted ALSA configuration file containing sparse bindings that trigger an out-of-bounds array read and assertion...
Security Bulletin: This Power System update is being released to address CVE-2026-17503
Summary Power Systems Firmware is affected by a vulnerability in the partition firmware runtime boot configuration. An attacker with root access to a partition can maliciously alter partition nvram, causing the partition to fail to boot. This condition persists until operator intervention —...
DRUPAL-CONTRIB-2026-174
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Webform did not sufficiently guard user-specific access rules against a malformed saved configuration. Under certain site-specific conditions, an access rule intended t...
DRUPAL-CONTRIB-2026-167
The Webform module enables site builders to create forms and collect submissions. The module does not sufficiently restrict access to configure Remote HTTP Operations handlers. This vulnerability could allow a user with permission to edit a webform to configure a remote HTTP operation. The update...
CVE-2026-18185
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to access sensitive information and modify system configurations due to missing authentication for a critical function...
EUVD-2026-85351
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to access sensitive information and modify system configurations due to missing authentication for a critical function...
CVE-2026-18185 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to access sensitive information and modify system configurations due to missing authentication for a critical function...
CVE-2026-18185 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to access sensitive information and modify system configurations due to missing authentication for a critical function...
CVE-2026-18185
IBM Financial Transaction Manager (FTM) for RedHat OpenShift is affected by CVE-2026-18185 , which stems from missing authentication for a critical function (CWE-306). A remote attacker could exploit this flaw to access sensitive information and modify system configurations . The vulnerability im...
CVE-2026-96675 alsa-lib through 1.2.16.1 Denial of Service via pcm_multi
alsa-lib through 1.2.16.1 contains a denial of service vulnerability in the multi PCM plugin that fails to validate sparse binding indices before array access. Attackers can supply a malicious ALSA configuration file with sparse bindings to trigger an out-of-bounds array read and assertion failur...
CVE-2026-86683
ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings...
CVE-2026-12370
ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager versions 12.8.667 and below were vulnerable to a Server-Side Template Injection vulnerability in Configlet processing, which could lead to Remote Code Execution...
CVE-2026-15358
ZohoCorp ManageEngine OpManager and Network Configuration Manager versions before 12.8.671 were vulnerable to an unauthorized Path Traversal vulnerability...
CVE-2026-15358
ZohoCorp ManageEngine OpManager and Network Configuration Manager versions prior to 12.8.671 are susceptible to an unauthorized Path Traversal vulnerability. This flaw allows for unauthorized access to restricted file system paths. Specific exploitation details and links are not provided in the d...
CVE-2026-15358 Path Traversal Vulnerability
ZohoCorp ManageEngine OpManager and Network Configuration Manager versions before 12.8.671 were vulnerable to an unauthorized Path Traversal vulnerability...