21878 matches found
CVE-2026-63700
Dell Wyse Management Suite WMS, versions prior to 2605.0.2, contain an Incorrect Default Permission vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation...
EUVD-2026-58708
Dell Wyse Management Suite WMS, versions prior to 2605.0.2, contain an Incorrect Default Permission vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation...
CVE-2026-63700
Dell Wyse Management Suite WMS, versions prior to 2605.0.2, contain an Incorrect Default Permission vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation...
CVE-2026-63700
Dell Wyse Management Suite (WMS) is affected by CVE-2026-63700 in versions prior to 2605.0.2, due to an Incorrect Default Permission issue. The vulnerability could allow a low-privileged attacker with local access to escalate privileges. The available documents confirm affected product (Dell Wyse...
GO-2026-4340 vulnerabilities
Vulnerabilities for packages: wave, sops, ingress-nginx-controller, thanos-operator, bom, gitleaks, mc, ip-masq-agent, litestream, nri-f5, x509-certificate-exporter, rancher-helm, nri-mongodb, gitlab-runner, cass-operator, spqr, vault-secrets-webhook, mesosphere-vsphere-csi,...
GO-2025-3955 vulnerabilities
Vulnerabilities for packages: thanos-operator, bom, ip-masq-agent, nri-f5, kind, emissary, nri-apache, spire-controller-manager, kubernetes-dashboard, aws-otel-collector, oauth2-proxy, migrate, kubernetes-csi-driver-hostpath, kubernetes-dashboard-api, aws-application-networking-k8s, eksctl,...
PT-2026-72051
Dell Wyse Management Suite WMS, versions prior to 2605.0.2, contain an Incorrect Default Permission vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation...
VulnCheck KEV: CVE-2026-58231
SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high...
CVE-2026-72839 filebrowser through 2.63.16 Privilege Escalation via Signup
filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is enabled with default CreateUserDir setting. Unauthenticated attackers can register accounts that inherit the server root scope with full create, modify, delete, rename, share, and download permissions...
CVE-2026-55400
CVE-2026-55400 describes an integer underflow in Secure Access servers prior to 14.57. With an authenticated session, an attacker can send specially crafted traffic to a server in a non-default configuration, causing a persistent denial of service. Affected product/version: Secure Access servers
CVE-2026-73488
Flowise CVE-2026-73488: An insecure direct object reference (IDOR) vulnerability in Flowise before 3.1.3 affects the GET /api/v1/organization/customer-default-source endpoint. Authenticated attackers can manipulate the customerId parameter to enumerate predictable customer IDs and access other cu...
CVE-2026-73488 Flowise before 3.1.3 IDOR via customer-default-source endpoint
Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET /api/v1/organization/customer-default-source endpoint that allows authenticated attackers to access other customers' payment and profile data by manipulating the customerId parameter. Attackers can...
Atlassian Questions For Confluence - Hardcoded Credentials
Atlassian Questions For Confluence contains a hardcoded credentials vulnerability. When installing versions 2.7.34, 2.7.35, and 3.0.2, a Confluence user account is created in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attack...
CVE-2026-18676 Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin
The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch from a malicious page returns the admin JWT and signing...
CVE-2025-59321
CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 contains a default TPM PCR policy that fails to consider the system boot state. This allows the TPM to be unsealed via an unintended execution path or from another hardware platform...
CVE-2025-41769
The device's PROFINET service is affected by a buffer overflow vulnerability that exists in the default configuration. An unauthenticated remote attacker could exploit this vulnerability to reboot the device or execute arbitrary code...
PT-2026-71069
Name of the Vulnerable Software and Affected Versions CryptoPro Secure Disk for Bitlocker versions prior to 7.7.4 Description The software contains a default TPM PCR policy that fails to consider the system boot state. This flaw allows the Trusted Platform Module TPM, a specialized chip used to...
EUVD-2025-210716
CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 contains a default TPM PCR policy that fails to consider the system boot state. This allows the TPM to be unsealed via an unintended execution path or from another hardware platform...
CVE-2026-48790 turso-cli persists Turso platform JWT with world-readable (0o644) file permissions
Turso CLI is the command line interface CLI to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform JWT to settings.json using Viper's default configPermissions of 0o644, leaving the credential file world-readable on standard Linux and macOS systems. Any othe...