4381 matches found
CVE-2026-8338
The CVE describes a Spring Security authentication and authorization bypass in Coverity Connect versions 2023.6.0–2026.3.0. An unauthenticated attacker can send a specially crafted HTTP request to bypass authentication/authorization on certain API endpoints and access data within Coverity. CVSS 4...
PT-2026-65676
The Wholesale for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.5. This is due to the save requests meta function applying only sanitize text field to the user role set POST parameter before passing it directly to WP User::add rol...
CVE-2025-60931
An Insecure Direct Object Reference IDOR in the Employee Compensation View function of Infor Global HR v11.24.10.01.33 allows unauthorized attackers to arbitrarily view the compensation information of other employees via a crafted GET request...
CVE-2026-16184
IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication by sending a crafted unauthenticated request...
CVE-2026-63303 Path Traversal in Quick.CMS
A Path Traversal vulnerability exists in Quick.CMS through the URI path component of HTTP requests, where the server fails to normalize dot-dot-slash ../ sequences before resolving and serving the requested file. An authenticated attacker with admin privileges can use this vulnerability to read...
httpd: NULL pointer dereference via specially crafted request
A flaw was found in the moddavlock module of httpd. This vulnerability allows a remote unauthenticated attacker to crash the server due to a NULL pointer dereference via a specially crafted request...
EUVD-2026-49638
An issue in the redirect parameter in Milk admin =0.9.8 allows remote attackers to redirect users to arbitrary external URLs via a crafted request...
PT-2026-65507
schreibfaul1 ESP32-audioI2S 3.4.5 has a heap-based buffer overflow vulnerability in the HTTP request header construction logic. The application dynamically splices attacker-controlled host name, path, query string, and multiple HTTP header fields into a fixed ps ptr heap buffer without proper siz...
CVE-2025-63913
An issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via crafted request to the SBI function 2 or the 'Find and configure a matching counter' function of SBI PMU extension...
CVE-2026-17568
Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group membership management permission to escalate privileges to administrator via a crafted API request. This issue affects : Devolutions Serv...
CVE-2026-17568
Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group membership management permission to escalate privileges to administrator via a crafted API request. This issue affects : Devolutions Serv...
CVE-2026-51565
Cross-site scripting XSS vulnerability in Modules/Docs/DocsController.php in Milk admin =0.9.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter in a crafted request...
CVE-2026-51564
An issue in the redirect parameter in Milk admin =0.9.8 allows remote attackers to redirect users to arbitrary external URLs via a crafted request...
Alibaba Cloud Linux 3 : 0212: cifs-utils (ALINUX3-SA-2026:0212)
The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0212 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-12505: A flaw was found in the cifs-utils...
Allocation of Resources Without Limits or Throttling
Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the Canvas functionality. An attacker can cause the server process to...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization through the RemoveDependency function. An attacker can modify issue dependencies and inject comments into private repositories by submitting a crafted request referencing the global issue ID of a private repository...
CVE-2026-15792
A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic...
EUVD-2026-46311
A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic...
Wazuh Cluster Distributed API Code Execution
The vulnerability of the Cluster Distributed API DAPI component of the Wazuh security monitoring and threat detection platform is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code with root privileges by...
httpd: NULL pointer dereference via specially crafted request
A flaw was found in the moddavlock module of httpd. This vulnerability allows a remote unauthenticated attacker to crash the server due to a NULL pointer dereference via a specially crafted request...