278041 matches found
CVE-2026-105806 Payload: Improper access control for MCP API keys
Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation through account takeover. This issue is fixed in version...
Always-Incorrect Control Flow Implementation
Overview vyper is a Pythonic Smart Contract Language for the EVM. Affected versions of this package are vulnerable to Always-Incorrect Control Flow Implementation in makereturnstmt in vyper/codegen/return.py when a return statement is executed inside a for loop, the loop's values are not popped...
CVE-2026-70411
Dell Container Storage Modules (CSM) versions prior to 1.18.0 are vulnerable to a Missing Authentication for Critical Function vulnerability within the csm-authorization-tenant gRPC service (TenantService) . An unauthenticated attacker positioned on an adjacent network could exploit this flaw to ...
CVE-2026-70411
Dell Container Storage Modules CSM, versions prior to 1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-tenant gRPC service TenantService. An unauthenticated adjacent network attacker could potentially exploit this vulnerability, leading to...
CVE-2026-82924
Improper Control of Interaction Frequency vulnerability in Pusula Communication, IT, and Internet Industry and Trade Co. Ltd. Expert Mail allows Brute Force. This issue affects Expert Mail: through 2026-09-18...
CVE-2026-82924 PII Enumeration via Missing Rate Limiting in Pusula Communication's Expert Mail
Improper Control of Interaction Frequency vulnerability in Pusula Communication, IT, and Internet Industry and Trade Co. Ltd. Expert Mail allows Brute Force. This issue affects Expert Mail: through 2026-09-18...
EUVD-2026-93415
Improper Control of Interaction Frequency vulnerability in Pusula Communication, IT, and Internet Industry and Trade Co. Ltd. Expert Mail allows Brute Force. This issue affects Expert Mail: through 2026-09-18...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.22.17 bug fix and security update
Red Hat OpenShift Container Platform release 4.22.17 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.22. Red Hat Product Security has rated this update as having a...
Exploit for Missing Authentication for Critical Function in Gfi Kerio_Control
!WARNING DISCLAIMER This proof-of-concept is provide...
Null Byte Injection
Netty is vulnerable to null byte injection. The vulnerability is due to the MqttEncoder not validating client identifiers, topics, usernames, and PUBLISH topic names before encoding, where prohibited null bytes can be inserted into MQTT UTF-8 string fields and attackers can exploit this by...
WordPress WPSection plugin <= 1.5.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Suhayb Ahmed in WordPress Plugin WPSection versions = 1.5.1...
WordPress Wordable plugin <= 8.2.10 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Aydan Arabadzha in WordPress Plugin Wordable versions = 8.2.10...
CVE-2026-105985
Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding...
CVE-2026-105985 Authenticated RCE via render-components Entry Type overrides
Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding...
CVE-2026-105985 Authenticated RCE via render-components Entry Type overrides
Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding...
EUVD-2026-93362
Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding...
CVE-2026-105985 Authenticated RCE via render-components Entry Type overrides
Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding...
CVE-2026-105985
Craft CMS 5.10.13.2 is vulnerable to authenticated remote code execution (RCE) within the Control Panel's app/render-components action. An authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides to manipulate an EntryType object's ...
Security Bulletin: Vulnerabilities exists in IBM Cloud Pak for Data System (Yosemite 1.0)
Summary Vulnerabilities identified in IBM Cloud Pak for Data System Yosemite 1.0 - NRS have been addressed in version 3.0.5.4 Vulnerability Details CVEID:CVE-2026-62574 DESCRIPTION: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Ja...