58536 matches found
CVE-2026-54593 Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions
Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained serveruuid, useruuid, and uniqueid claims without checking the token's intended purpose;...
EUVD-2026-49880
Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained serveruuid, useruuid, and uniqueid claims without checking the token's intended purpose;...
CVE-2026-54593
Vulnerability summary: CVE-2026-54593 affects Pterodactyl Panel and Wings prior to versions 1.12.3 and 1.12.2, respectively. The Wings /upload/file endpoint accepted any valid panel-signed JWT containing server_uuid, user_uuid, and unique_id without enforcing the intended purpose. Since Panel iss...
CVE-2026-15014
creationtimestamp| type| source ---|---|--- 2026-07-28 15:24:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrppqxciid2s...
CVE-2026-66919
creationtimestamp| type| source ---|---|--- 2026-07-28 15:22:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrppo3g6oa2e...
CVE-2026-62433
creationtimestamp| type| source ---|---|--- 2026-07-28 15:14:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrpp7ovqzg2s 2026-07-28 15:33:19+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mrpqbieqah2n 2026-07-29 13:55:22+00:00| seen|...
CVE-2026-7187
creationtimestamp| type| source ---|---|--- 2026-07-28 15:05:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrpopepcn72s 2026-07-28 16:01:07+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrprt6dsa32c...
CVE-2026-42492
creationtimestamp| type| source ---|---|--- 2026-07-28 14:57:56+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mrpoc7ttwi2r 2026-07-29 13:55:21+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrs3axvf5z24 2026-07-29 13:55:25+00:00| seen|...
CVE-2026-66918
creationtimestamp| type| source ---|---|--- 2026-07-28 14:50:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrpnvsfk6c2q...
CVE-2026-58216
creationtimestamp| type| source ---|---|--- 2026-07-28 14:25:06+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrpmhj66mu27...
CVE-2026-58218
creationtimestamp| type| source ---|---|--- 2026-07-28 14:25:06+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrpmhj66mu27 2026-07-31 12:01:51+00:00| seen| https://bsky.app/profile/bootintel.bsky.social/post/3mrwvu4gbhz2t...
CVE-2026-58221
creationtimestamp| type| source ---|---|--- 2026-07-28 14:25:06+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrpmhj66mu27 2026-07-29 12:45:02+00:00| seen| https://www.acn.gov.it/portale/w/nuove-vulnerabilita-in-samba-1 2026-08-01 21:40:36+00:00| seen|...
CVE-2018-12913
creationtimestamp| type| source ---|---|--- 2026-07-28 13:00:04+00:00| seen| https://t.me/AssasinsOfficial/231 2026-07-29 00:00:35+00:00| published-proof-of-concept| https://t.me/AssasinsOfficial/231...
CVE-2026-11598
creationtimestamp| type| source ---|---|--- 2026-07-28 11:37:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrpd4byovt22...
CVE-2026-18028 Missing authorization check in event quick setup view
The "quick setup" view presented to users after they first create an event allows to set up the most critical parts of an event in just a few clicks. This view did not properly check that the user has permission to change configuration for the given event. An attacker could use a well-timed reque...
CVE-2026-18028 Missing authorization check in event quick setup view
The "quick setup" view presented to users after they first create an event allows to set up the most critical parts of an event in just a few clicks. This view did not properly check that the user has permission to change configuration for the given event. An attacker could use a well-timed reque...
CVE-2026-14167
creationtimestamp| type| source ---|---|--- 2026-07-28 09:10:33+00:00| seen| https://bsky.app/profile/certvde.infosec.exchange.ap.brid.gy/post/3mrp2uww2wo32 2026-07-28 11:32:01+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrpcrz7cxf2p...
CVE-2026-14169 ads-tec Industrial IT: Account lockout via non-atomic user creation
Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted input and overwrites existing user passwords which could result in complete administrative unavailability of the device...