19953 matches found
CVE-2026-30956
CVE-2026-30956 relates to OneUptime with advisory GHSA-R5V6-2599-9G3M and OSV-GHSA-R5V6-2599-9G3M describing an authorization bypass in v10.0.20. The root cause is that the API trusts a client-controlled is-multi-tenant-query header to bypass tenant isolation, causing the system to skip Table/Que...
CVE-2026-30956
OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, a low‑privileged user can bypass authorization and tenant isolation in OneUptime v10.0.20 and earlier by sending a forged is-multi-tenant-query header together with a controlled projectid header. Because the...
EUVD-2026-10560
OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, a low‑privileged user can bypass authorization and tenant isolation in OneUptime v10.0.20 and earlier by sending a forged is-multi-tenant-query header together with a controlled projectid header. Because the...
Windows Shell Link Processing Spoofing Vulnerability
Exposure of sensitive information to an unauthorized actor in Windows Shell Link Processing allows an unauthorized attacker to perform spoofing over a network...
CVE-2026-28431
Misskey is an open source, federated social media platform. All Misskey servers running versions 8.45.0 and later, but prior to 2026.3.1, contain a vulnerability that allows bad actors access to data that they ordinarily wouldn't be able to access due to insufficient permission checks and proper...
CVE-2026-1919
Booktics (WordPress plugin) up to version 1.0.16 is affected by missing capability checks on multiple REST API endpoints, enabling unauthenticated access to sensitive data. Affected component: Booktics REST endpoints; root cause: insufficient authorization checks. Impact: unauthorized queries of ...
CVE-2026-1919 Booktics <= 1.0.16 - Missing Authorization to Get Items via REST API endpoints
The Booking Calendar for Appointments and Service Businesses – Booktics plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple REST API endpoints in all versions up to, and including, 1.0.16. This makes it possible for unauthenticated...
CVE-2025-56421
SQL Injection vulnerability in LimeSurvey before v.6.15.4+250710 allows a remote attacker to obtain sensitive information from the database...
Intel Processors 安全漏洞
Intel Processors are a series of processors developed by the American company Intel. There are security vulnerabilities in Intel Processors, which stem from race conditions between the check time and the use time. These vulnerabilities may lead to information leaks. System software attackers with...
PT-2026-24174
The Booking Calendar for Appointments and Service Businesses – Booktics plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple REST API endpoints in all versions up to, and including, 1.0.16. This makes it possible for unauthenticated...
Fortinet FortiAnalyzer Lack of TLS Certificate Validation during initial SSO Authentication (FG-IR-26-078)
The version of FortiAnalyzer installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-26-078 advisory. - A improper certificate validation vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0...
SAP NetWeaver Application Server for ABAP 安全漏洞
SAP NetWeaver Application Server for ABAP is a core application server platform developed by the German company SAP. There is a security vulnerability in SAP NetWeaver Application Server for ABAP, which stems from the lack of authorization checks. This vulnerability may lead to the reading of...
PT-2026-24405
IBM Aspera Orchestrator 3.0.0 through 4.1.2 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history...
IBM Aspera Orchestrator 安全漏洞
IBM Aspera Orchestrator is a web-based application developed by IBM. It provides efficient file processing pipelines for data-driven businesses. There were security vulnerabilities in the version 3.0.0 to 4.1.2 of IBM Aspera Orchestrator. These vulnerabilities stemmed from the storage of sensitiv...
Eaton Easysoft 安全漏洞
Eaton Easysoft is a programming application used in the industrial field by Eaton, Inc. This software is used for programming Easy controllers and displays. It allows for the editing and visualization of circuit diagrams according to specified formats. Eaton Easysoft has security vulnerabilities;...
SAP S/4HANA HCM Portugal和SAP ERP HCM Portugal 安全漏洞
SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal are both human capital management modules developed by the German company SAP. Both systems have security vulnerabilities; these vulnerabilities stem from the lack of authorization checks, which may allow users with high privileges to access...
The vulnerability of the simplefb component in the Linux operating system’s kernel allows a perpetrator to gain access to confidential data, compromise its integrity, and cause service failures.
The vulnerability of the simplefb component in the Linux operating system’s kernel is related to the use of memory after it is freed. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data, compromise its integrity, and cause service failures...
EUVD-2026-10425
Shescape is a simple shell escape library for JavaScript. Prior to 2.1.9, an attacker may be able to bypass escaping for the shell being used. This can result, for example, in exposure of sensitive information. This impacts users of Shescape that configure their shell to point to a file on disk...
EUVD-2026-10424
Shescape is a simple shell escape library for JavaScript. Prior to 2.1.9, an attacker may be able to bypass escaping for the shell being used. This can result, for example, in exposure of sensitive information. This impacts users of Shescape that configure their shell to point to a file on disk...