19903 matches found
CVE-2026-76320
CVE-2026-76320 is a Cross-Site Request Forgery (CSRF) vulnerability in the Event Type Builder of Splunk Web (Splunk Enterprise). The Event Type Builder accepts cross-site request input and retains SPL-affecting values while building sample event searches, allowing an unauthenticated attacker to c...
CVE-2026-14978
go-slug v0.4.0-v0.18.2 mishandles Unicode normalization during .terraformignore matching (CWE-176), allowing files differing only by normalization form to bypass exclusions and be uploaded to Terraform Cloud/Enterprise, exposing sensitive local files. Fixed in v0.18.3; no workaround provided. Exp...
CVE-2026-55703
creationtimestamp| type| source ---|---|--- 2026-08-19 20:35:05+00:00| published-proof-of-concept| https://github.com/grokability/snipe-it/security/advisories/GHSA-r9r3-g9fp-3q4q...
CVE-2026-68559
Wekan is open source kanban built with Meteor. From 9.57 until 9.74, the /api/boards/:boardId/exportExcel route in models/exportExcel.js called the asynchronous exporterExcel.canExportuser authorization guard from models/server/ExporterExcel.js without awaiting it. The returned Promise was always...
CVE-2026-68559 Wekan: Broken access control in the Excel-export route (`/api/boards/:boardId/exportExcel`)
Wekan is open source kanban built with Meteor. From 9.57 until 9.74, the /api/boards/:boardId/exportExcel route in models/exportExcel.js called the asynchronous exporterExcel.canExportuser authorization guard from models/server/ExporterExcel.js without awaiting it. The returned Promise was always...
EUVD-2026-62628
Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a company-scoped user in FMCS floater mode can access users whose companyid is null because broad API queries and bulk web actions do not consistently apply isCurrentUserHasAccess. The /api/v1/users and /api/v1/users/id/licenses...
CVE-2026-55703 Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET
Snipe-IT is an IT asset/license management system. Prior to 8.6.3, any activated account can request /maintenances/id and read maintenance records for assets in the same company without asset or maintenance permission. app/Http/Controllers/MaintenancesController.php show renders the record withou...
CVE-2026-70822
creationtimestamp| type| source ---|---|--- 2026-08-19 17:51:23+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...
CVE-2026-62536
creationtimestamp| type| source ---|---|--- 2026-08-19 17:49:32+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...
CVE-2026-71150
creationtimestamp| type| source ---|---|--- 2026-08-19 17:48:35+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10 2026-08-27 01:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtzpju6zgf22...
MINI-XQRQ-FX3V-H5CG
Bulletin has no description...
MINI-88FH-89X6-QC92
Bulletin has no description...
CVE-2026-20320
A vulnerability in the Open Client Interface OCI XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. This vulnerability exists because XML entries are improperly parsed due to external entity resolution...
CVE-2026-71010
creationtimestamp| type| source ---|---|--- 2026-08-19 16:49:09+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...
CVE-2026-70731
creationtimestamp| type| source ---|---|--- 2026-08-19 16:46:55+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...
CVE-2026-16019
creationtimestamp| type| source ---|---|--- 2026-08-19 16:08:05+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mth4hvptjp2m 2026-08-19 16:10:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mth4lhxgtt25...
MINI-J7VQ-VM22-VJMW
Bulletin has no description...
MINI-55FM-6VF8-36M9
Bulletin has no description...
CVE-2026-76205 phpMyFAQ before 4.1.7 SQL Injection via Glossary
phpMyFAQ before 4.1.7 contains a SQL injection vulnerability in the glossary create and update endpoints caused by truncating an escaped string before embedding it in a SQL literal. Authenticated users with glossary add or edit permissions can craft a payload with a dangling backslash to escape t...