784 matches found
fierce
Fierce Fierce is a DNS reconnaissance tool for locating non-contiguous IP space. Useful links: Domain Name System DNS Domain Names - Concepts and Facilities Domain Names - Implementation and Specification Threat Analysis of the Domain Name System DNS Name Servers NS State of Authority Record SOA...
CVE-2026-85311
Missing Authorization vulnerability in Kings Plugins MarketKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MarketKing: from n/a through 2.1.60...
EUVD-2026-70970
Missing Authorization vulnerability in Kings Plugins MarketKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MarketKing: from n/a through 2.1.60...
EUVD-2026-70969
Missing Authorization vulnerability in WC Lovers WCFM Membership allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WCFM Membership: from n/a through 2.11.11...
CVE-2026-74010
Missing Authorization vulnerability in John James Jacoby bbPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects bbPress: from n/a through 2.6.14...
CVE-2026-16257
The Arvow AI SEO Writer WordPress plugin before 1.5.4 does not properly restrict access to one of its REST endpoints, whose only access control can be bypassed by unauthenticated users through type juggling when the Arvow AI SEO Writer WordPress plugin before 1.5.4 has not been configured, allowi...
CVE-2026-11430
Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook token check. When the webhook feature is enabled but no webhookToken is configured, a compound conditional short-circuits and skips token validation, so an unauthenticated remote attacker who can reach POST...
CVE-2026-11430
Grav CMS’s scheduler-webhook plugin contains an authentication bypass in the webhook token check. When the webhook feature is enabled but no webhookToken is configured, a conditional short-circuit skips token validation, allowing an unauthenticated remote attacker who can reach POST /scheduler/we...
Important: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.2 security update
Updated images are now available for Red Hat Ansible Automation Platform 2.2, which include new features, bug fixes, and enhancements for the Red Hat Ansible Automation Portal bootable container image. Red Hat Ansible Automation Platform 2.2 delivers the Ansible Automation Portal as a bootable...
CVE-2026-71309 rclone: Incomplete path validation allows backend root escape in serve restic
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic does not correctly reject URL paths beginning with ../ in cmd/serve/restic/restic.go WithRemote, which accepts a leading parent path and pass...
CVE-2026-18830
Insufficient input validation in Amazon Bedrock AgentCore harness might allow an authenticated remote user to execute configured tools bypassing model invocation and security controls via crafted content blocks in conversation messages. AWS has addressed this issue. No customer action is required...
sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation
A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...
CVE-2026-18108
Net::SAML2 versions before 0.86 for Perl allow authentication bypass because verifyencryptedassertion accepts an EncryptedAssertion whose decrypted content carries no signature. verifyencryptedassertion decrypts the EncryptedAssertion and returns it as verified when it carries no signature, via...
JetBrains PhpStorm < 2026.2 Multiple Vulnerabilities
According to its self-reported version, the JetBrains PhpStorm installation on the remote host is prior to 2026.2. It is, therefore, affected by a multiple vulnerabilities. - In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via project toolin...
CVE-2026-15977
SGLang contains a credential leakage vulnerability in the /serverinfo endpoint, which will return API keys and SSL keyfile information when only the --admin-api-key is configured...
CVE-2026-15977
SGLang contains a credential leakage vulnerability in the /serverinfo endpoint, which will return API keys and SSL keyfile information when only the --admin-api-key is configured...
SUSE CVE-2026-54090
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.33.8, when a shell interpreter is configured e.g. /bin/sh -c, the command allowlist can be bypassed through shell metacharacters. The allowlist...
EUVD-2026-49888
Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::removeprefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL. Attackers can send a request whose decoded path matches a configured prefix whi...
SUSE CVE-2026-41637
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC DoQ queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of replies for already in-flight resolution queries. This results in degradation of resolution service f...
