22176 matches found
Juniper Networks Support Insights Virtual Lightweight Collector 安全漏洞
Juniper Networks Support Insights Virtual Lightweight Collector is a network device telemetry data collection and operational analysis tool developed by Juniper Networks. Versions of Juniper Networks Support Insights Virtual Lightweight Collector prior to version 3.0.94 contained security...
Always-Incorrect Control Flow Implementation
Overview Affected versions of this package are vulnerable to Always-Incorrect Control Flow Implementation in the SslBundle.getBundle function. When the spring.ssl.bundle property name is not empty configuration is silently changed to the default SSL configuration. Remediation Upgrade...
PT-2026-31803
Name of the Vulnerable Software and Affected Versions Juniper Networks Support Insights JSI Virtual Lightweight Collector vLWC versions prior to 3.0.94 Description A Use of Default Password issue in Juniper Networks JSI Virtual Lightweight Collector vLWC allows an unauthenticated, network-based...
OpenPLC Runtime version 3 安全漏洞
OpenPLC Runtime version 3 is a programmable logic controller developed by Thiago Alves. There is a security vulnerability in OpenPLC Runtime version 3, which stems from the use of unsafe default values during resource initialization. This vulnerability could allow attackers to access the system...
PT-2026-31798
Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS on MX Series versions prior to 23.2R2-S6 Juniper Networks Junos OS on MX Series versions 23.4 before 23.4R2-S7 Juniper Networks Junos OS on MX Series versions 24.2 before 24.2R2 Juniper Networks Junos OS on MX Series...
Apache Tomcat 安全漏洞
Apache Tomcat is a lightweight web application server developed by the Apache Foundation in the United States. It supports Servlet and JavaServer Page JSP technologies. There are security vulnerabilities in Apache Tomcat versions 11.0.18 and earlier, 10.1.52 and earlier, 9.0.115 and earlier,...
CVE-2026-40035
Unfurl through 2025.08 contains an improper input validation vulnerability in config parsing that enables Flask debug mode by default. The debug configuration value is read as a string and passed directly to app.run, causing any non-empty string to evaluate truthy, allowing attackers to access th...
CVE-2026-40035 Unfurl - Werkzeug Debugger Exposure via String Config Parsing
Unfurl through 2025.08 contains an improper input validation vulnerability in config parsing that enables Flask debug mode by default. The debug configuration value is read as a string and passed directly to app.run, causing any non-empty string to evaluate truthy, allowing attackers to access th...
EUVD-2026-20538
Use of Default Cryptographic Key in the hardware for some IntelR PentiumR Processor Silver Series, IntelR CeleronR Processor J Series, IntelR CeleronR Processor N Series may allow an escalation of privilege. Hardware reverse engineer adversary with a privileged user combined with a high complexit...
CVE-2026-35585
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. From 2.0.0 until 2.33.8, the hook system in File Browser — which executes administrator-defined shell commands on file events such as upload, rename, and delete...
CVE-2026-20709
Use of Default Cryptographic Key in the hardware for some IntelR PentiumR Processor Silver Series, IntelR CeleronR Processor J Series, IntelR CeleronR Processor N Series may allow an escalation of privilege. Hardware reverse engineer adversary with a privileged user combined with a high complexit...
CVE-2026-20709
This CVE (CVE-2026-20709) concerns the use of a default cryptographic key embedded in hardware on select Intel processors (Pentium Silver, Celeron J/N series). The root cause is a default key in hardware that could be exploited by a hardware reverse engineer with privileged access and high attack...
CVE-2026-20709
Use of Default Cryptographic Key in the hardware for some IntelR PentiumR Processor Silver Series, IntelR CeleronR Processor J Series, IntelR CeleronR Processor N Series may allow an escalation of privilege. Hardware reverse engineer adversary with a privileged user combined with a high complexit...
CVE-2026-20709
Use of Default Cryptographic Key in the hardware for some IntelR PentiumR Processor Silver Series, IntelR CeleronR Processor J Series, IntelR CeleronR Processor N Series may allow an escalation of privilege. Hardware reverse engineer adversary with a privileged user combined with a high complexit...
Incorrect Default Permissions
Amendment This was deemed not a vulnerability. Overview ansible is a simple IT automation system. Affected versions of this package are vulnerable to Incorrect Default Permissions via excessive group-writable permissions on the /etc/passwd file during the build process. An attacker can gain full...
libssh: libssh: Insecure default configuration leads to local man-in-the-middle attacks on Windows
A flaw was found in libssh. This vulnerability allows local man-in-the-middle attacks, security downgrades of SSH Secure Shell connections, and manipulation of trusted host information, posing a significant risk to the confidentiality, integrity, and availability of SSH communications via an...
CVE-2026-1163
An insufficient session expiration vulnerability exists in the latest version of parisneo/lollms. The application fails to invalidate active sessions after a password reset, allowing an attacker to continue using an old session token. This issue arises due to the absence of logic to reject reques...
CVE-2026-1163 Insufficient Session Expiration in parisneo/lollms
An insufficient session expiration vulnerability exists in the latest version of parisneo/lollms. The application fails to invalidate active sessions after a password reset, allowing an attacker to continue using an old session token. This issue arises due to the absence of logic to reject reques...
CVE-2026-1163
CVE-2026-1163 describes an insufficient session expiration in the latest version of parisneo/lollms, where active sessions are not invalidated after a password reset due to missing logic to reject idle requests and a default 31-day session duration. This enables a compromised account to retain ac...
