1697 matches found
CVE-2026-84736
In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federator component disables TLS certificate validation for outbound HTTPS connections by default. When the TLSCERTIFICATEVALIDATION environment variable is unset or set to false, the...
SUSE CVE-2026-55857
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, PAM dialog authentication can be coerced into transmitting the account password over an insecure connection. The mysqlclearpassword plugin is gated behin...
PT-2026-85084
In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federator component disables TLS certificate validation for outbound HTTPS connections by default. When the TLS CERTIFICATE VALIDATION environment variable is unset or set to false, the...
Lack of transparency in JFrog Artifactory
JFrog has identified a vulnerability in JFrog Artifactory. This vulnerability resides in the default configuration of JFrog Artifactory, where insufficient authentication controls are in place. As a result, an unauthenticated attacker can escalate their privileges to administrative level using...
CVE-2026-19723
The Social Media Share Buttons & Social Sharing Icons WordPress plugin versions before 3.0.1 is vulnerable to Reflected Cross-Site Scripting (XSS) . The flaw occurs because the plugin fails to properly escape a value from an incoming request before outputting it into an inline JavaScript event ha...
JFrog Artifactory Improper Authentication Vulnerability
JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges...
VulnCheck KEV: CVE-2026-82329
JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges...
CVE-2026-62388
A flaw was found in NLTK. The software's default settings in pathsec.py cause security checks to only issue warnings rather than actively preventing malicious actions. This allows attackers to bypass safeguards designed to prevent unauthorized access to files path traversal and the execution of...
CVE-2026-82838 Default webserver configuration with incorrect CSP
The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set...
github.com/getkin/kin-openapi: kin-openapi: kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default
A flaw was found in kin-openapi. This vulnerability allows a remote attacker to bypass authentication checks. Specifically, the system incorrectly handles missing authentication configurations, substituting them with a function that does not verify user credentials. This enables unauthorized acce...
CVE-2026-82329
JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges...
CVE-2026-82329
CVE-2026-82329 is a critical authentication bypass in JFrog Artifactory (self-managed), rooted in the JFrog Access service. On default installations, a blank join key is silently trusted, and its HMAC secret is a fully known 32-byte value of 0x20. An unauthenticated attacker forges a valid join J...
CVE-2026-82329 Potential authentication bypass leading to administrative access in Artifactory
JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges...
CVE-2026-82329 Potential authentication bypass leading to administrative access in Artifactory
JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges...
EUVD-2026-67861
JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges...
CVE-2026-82266 Redpanda Admin API Unauthenticated Superuser Access via Default Configuration
Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with adminapirequireauth defaulting to false, treating unauthenticated requests as superusers. Attackers can reach port 9644 without credentials to create and delete broker accounts, modify cluster configuration, and disrupt partition...
CVE-2026-82266 Redpanda Admin API Unauthenticated Superuser Access via Default Configuration
Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with adminapirequireauth defaulting to false, treating unauthenticated requests as superusers. Attackers can reach port 9644 without credentials to create and delete broker accounts, modify cluster configuration, and disrupt partition...
CVE-2026-82266
Redpanda through 26.2.2 ships with its Admin API bound to 0.0.0.0:9644 and admin_api_require_auth defaulting to false, meaning unauthenticated requests are treated as superusers . An attacker with network access to port 9644 can create and delete broker accounts, modify cluster configuration, and...
CVE-2026-82266 Redpanda Admin API Unauthenticated Superuser Access via Default Configuration
Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with adminapirequireauth defaulting to false, treating unauthenticated requests as superusers. Attackers can reach port 9644 without credentials to create and delete broker accounts, modify cluster configuration, and disrupt partition...
