227753 matches found
CVE-2026-65613
Apache CloudStack versions 4.20.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 are affected by an access control flaw in the Webhook module . The issue allows an unauthorized actor to list and delete webhook deliveries , leading to exposure of sensitive information . The vulnerability require...
CVE-2026-66721
Apache CloudStack has a missing authorization flaw in its listHostTags API . Domain Admins can invoke this API by default, but the endpoint returns host tags for every host in the environment rather than being scoped to the admin's own domain. This exposes host tag information across domain bound...
CVE-2026-66797
Apache CloudStack versions 4.15.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 are affected by an improper access control flaw in the annotation functionality. The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified but fail to honor its result,...
CVE-2026-66797 Apache CloudStack: Unauthorised comment creation and disclosure
Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user...
EUVD-2026-63831
Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user...
CVE-2026-53791
A flaw in rsync allows an unauthenticated remote attacker to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source IP address, granting unauthorized access to restricted resources. Mitigation Restrict rsync daemon TCP/873 to the trusted proxy only CME-202...
CVE-2026-75796
The AI Engine WordPress plugin before 3.6.1 does not verify that the requesting user is authorized to act on the targeted account before performing privileged user management operations, allowing users with the Administrator role on a Multisite sub-site to take over any account on the network,...
CVE-2026-19085
The Duplicate Post WordPress plugin before 1.5.6 does not check that a user may read the content of a post before duplicating it, allowing users with a delegated role to republish another user's password-protected post as publicly readable...
CVE-2026-16575
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not restrict access to per-vendor commission configuration returned by one of its unauthenticated store REST endpoints, allowing any unauthenticated user to disclose a vendor's commission type...
EUVD-2026-63823
The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allowing users with a delegated role to read the content, metadata and passwords of posts they are not allowed to access, including other users' private and draft content...
EUVD-2026-63813
The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing anonymous visitors to read member email addresses and phone numbers that are configured to be visible to members only...
NorthStarC2
NorthStarC2 هو إطار عمل مفتوح المصدر للقيادة والتحكم تم تطويره لأغراض اختبار الاختراق والفريق الأحمر بواسطة Engin Demirbilek. يتكون إطار عمل NorthStar C2 من تطبيقين: تطبيق ويب بواجهة رسومية على جانب الخادم لإدارة الجلسات، و stager على جانب العميل للتواصل مع خادم C2. التثبيت السريع git clone...
CVE-2026-76158 Datiphy Data Management Center - External Control of File Name or Path
External Control of File Name or Path in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to write files to arbitrary locations outside the intended upload directory via relative or absolute path sequences...
CVE-2026-76158
Datiphy Data Management Center (v8.3.0 through v8.5.1) contains a path traversal vulnerability in its upload API endpoint. An unauthenticated remote attacker can supply relative or absolute path sequences to write files to arbitrary locations outside the intended upload directory, enabling arbitr...
CVE-2026-77649
The internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...
EUVD-2026-63780
The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...
CVE-2026-77650
The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...
EUVD-2026-63779
The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...
SUSE CVE-2026-76827
A flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed search data. This is possible because the delta-sync write paths in search-indexer do not properly restrict UPDATE/DELETE operations to...