23859 matches found
PT-2026-68214
Name of the Vulnerable Software and Affected Versions Progress MarkLogic Server versions prior to 11.3.6 Progress MarkLogic Server versions prior to 12.0.3 Description Improper privilege management in the SQL, SPARQL, and Optic REST query interfaces allows an authenticated user with a...
CVE-2025-63822
SirenGPS Android Application 2.19.44 is vulnerable to Incorrect Access Control. An authenticated attacker can manipulate user identifier parameters to bypass authorization controls and gain unauthorized READ and WRITE access to other users' personal information. The API fails to validate that the...
The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge web browsers allows attackers to access confidential data.
The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge is related to errors in handling HTTP requests. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data through a specially created HTML page...
CVE-2025-63822
SirenGPS Android Application 2.19.44 is vulnerable to Incorrect Access Control. An authenticated attacker can manipulate user identifier parameters to bypass authorization controls and gain unauthorized READ and WRITE access to other users' personal information. The API fails to validate that the...
openjdk: Improve certification checking (Oracle CPU 2026-07)
A flaw was found in OpenJDK. OpenJDK can apply two different security meanings to the same wildcard dNSName SAN across certificate policy enforcement and hostname verification. During path validation, DNSName.constrains compares .foo.com and secret.foo.com literally and returns NAMESAMETYPE, so...
CVE-2026-63455
Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive...
CVE-2026-63455 Authentication bypass via spoofed HTTP headers Orchestrator REST API
Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive...
ROS-20260804-73-0009
The vulnerability of Linux kernel’s rose components is related to errors during link counter updates. Exploiting this vulnerability allows an attacker to access confidential data, compromise its integrity, and cause service failures...
ROS-20260804-73-0013
The vulnerability of the arch/x86 kernel component of the Linux operating system is related to resource leaks. Exploiting this vulnerability allows an attacker to gain access to confidential data...
Amazon Linux 2023 : java-25-amazon-corretto, java-25-amazon-corretto-devel, java-25-amazon-corretto-headless (ALAS2023-2026-2020)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2020 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java S...
Amazon Linux 2023 : java-11-amazon-corretto, java-11-amazon-corretto-devel, java-11-amazon-corretto-headless (ALAS2023-2026-2018)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2018 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java S...
PT-2026-67747
Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3 Description An issue exists where the '/api/v1/files' endpoint is protected only by a feature gate and fails to enforce permission checks on GET and DELETE requests. This allows an authenticated user with a...
CVE-2026-46712
Misskey is an open source, federated social media platform. Versions 2025.3.2 and later, but prior to 2026.5.4, contain a vulnerability where a lack of proper permission checks allows access to certain data points from the Direct Messages formerly Chat feature, regardless of account permissions...
CVE-2026-46712 Misskey: Lack of proper permission checks in Direct Messaging feature
Misskey is an open source, federated social media platform. Versions 2025.3.2 and later, but prior to 2026.5.4, contain a vulnerability where a lack of proper permission checks allows access to certain data points from the Direct Messages formerly Chat feature, regardless of account permissions...
CVE-2026-48115 Misskey: Improper Authorization in the Announcements API
Misskey is an open source, federated social media platform. All Misskey servers running versions 2024.5.0 and later, but prior to 2026.5.4, contain a vulnerability in the Server Announcements API where insufficient permission checks allow attackers to access limited portions of data that they...
CVE-2026-67610
OpenEMR through 8.2.0 contains an improper authentication vulnerability in the OAuth2 dynamic client registration endpoint that allows unauthenticated attackers to register a malicious client with system-level FHIR scopes by supplying a self-generated RSA keypair via the jwks field. Once an...
CVE-2026-41453
Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authenticated users with leads access to inject arbitrary SQL into a HAVING clause by manipulating the rottenleadin query parameter, which is concatenated without parameterized binding directly...
CVE-2026-69084
SiYuan versions = v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle with no single-statement, read-only, or admin restrictions. The endpoint is gated only by CheckAuth, making it reachable by the...
SUSE-SU-2026:3453-1 Security update for java-11-openjdk
This update for java-11-openjdk fixes the following issues: Upgrade to upstream tag jdk-11.0.32+9 July 2026 CPU. Security issues fixed: - CVE-2026-41254: lcms: information disclosure and denial of service via integer overflow in CubeSize bsc1264994. - CVE-2026-46917: unauthenticated attacker with...