225621 matches found
Azure App Service on Azure Stack Hub Elevation of Privilege Vulnerability
Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network...
Azure API Management (APIM) Remote Code Execution Vulnerability
Improper access control in Azure API Management APIM allows an authorized attacker to execute code over a network...
CVE-2026-65907
In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible...
EUVD-2026-48253
In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible...
CVE-2026-65907
The vulnerability affects JetBrains TeamCity prior to 2026.1.2, where code execution was possible in Git VCS roots (2025.11.6). The issue is tied to TeamCity’s Git VCS integration, with impact described as CRITICAL (CVSS 3.1). Remediation: upgrade to TeamCity 2026.1.2 or later as indicated by the...
CVE-2026-65531
Unauthenticated Broken Access Control in Qubely = 1.8.14 versions...
CVE-2026-65895 Grav API Plugin before 1.0.10 Broken Access Control
Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.config.write privilege to modify rate limiting and CORS settings. Attackers can disable rate limiting site-wide to enable credential...
CVE-2026-65895 Grav API Plugin before 1.0.10 Broken Access Control
Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.config.write privilege to modify rate limiting and CORS settings. Attackers can disable rate limiting site-wide to enable credential...
PYSEC-2026-3477 LiteLLM: Arbitrary file write via path traversal in Skills archive extraction
Impact LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives. An authenticated user with access to LiteLLM LLM API routes, or a key whose allowedroutes includes /v1/skills, anthropicroutes, or llmapiroutes, could upload a crafted skill archive...
OpenStack oslo.messaging does not verify RabbitMQ broker hostname during TLS handshake
An issue was discovered in OpenStack oslo.messaging 1.0.0 through 17.3.0. The oslo.messaging RabbitMQ driver does not perform TLS hostname verification when connecting to the message broker. When sslcafile is configured, the driver enables certificate chain validation but does not pass the expect...
PYSEC-2026-3491 OpenStack Neutron: Neutron port RBAC policy bypass allows project managers to set trusted device owners on shared networks
In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another project and set deviceowner to a value that has "network:" at the beginning "network:dhcp" for example. The default port RBAC policies incorrectly included PROJECTMANAGER without...
WordPress CoCart – Headless ecommerce plugin <= 4.8.4 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by VanTastic in WordPress Plugin CoCart – Headless ecommerce versions = 4.8.4...
WordPress Thrive Product Manager plugin <= 10.9.2 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Austin Ginder in WordPress Plugin Thrive Product Manager versions = 10.9.2...
EUVD-2026-48138
Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names = 1.3.3 versions...
CVE-2026-65537
Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names = 1.3.3 versions...
CVE-2026-65537
CVE-2026-65537 concerns a WordPress plugin, Cyr to Lat reloaded – transliteration of links and file names , affected in versions
CVE-2026-65531
Unauthenticated Broken Access Control in Qubely = 1.8.14 versions...
CVE-2026-65531 WordPress Qubely plugin <= 1.8.14 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Qubely = 1.8.14 versions...