55518 matches found
EUVD-2026-88625
A vulnerability was identified in Rebuild up to 4.4.7/4.5.0-beta5. This affects an unknown part of the file /user/login of the component Login Endpoint. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit is publicly available and might b...
CVE-2026-102245 MODSetter SurfSense circleback Endpoint circleback_webhook_route.py missing authentication
A weakness has been identified in MODSetter SurfSense up to 2.0.3. The affected element is an unknown function of the file surfsensebackend/app/routes/circlebackwebhookroute.py of the component circleback Endpoint. Executing a manipulation can lead to missing authentication. The attack can be...
CVE-2026-102245 MODSetter SurfSense circleback Endpoint circleback_webhook_route.py missing authentication
A weakness has been identified in MODSetter SurfSense up to 2.0.3. The affected element is an unknown function of the file surfsensebackend/app/routes/circlebackwebhookroute.py of the component circleback Endpoint. Executing a manipulation can lead to missing authentication. The attack can be...
CVE-2026-102245
A vulnerability exists in MODSetter SurfSense versions up to 2.0.3 within the circleback Endpoint component. Specifically, an unknown function in the file surfsense_backend/app/routes/circleback_webhook_route.py lacks proper authentication, allowing for remote exploitation. Public exploits are av...
EUVD-2026-88619
A weakness has been identified in MODSetter SurfSense up to 2.0.3. The affected element is an unknown function of the file surfsensebackend/app/routes/circlebackwebhookroute.py of the component circleback Endpoint. Executing a manipulation can lead to missing authentication. The attack can be...
CVE-2026-97685 LimeSurvey Community Edition 7.3.0 - Cross-survey object authorization bypass in REST survey patch operations
An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an authorized context while supplying question or answer identifiers belonging to another user's survey. The REST survey-patching endpoint checks the attacker's permission against the...
PT-2026-102499
Apache Airflow's Snowflake provider did not validate the connection's account and region fields before interpolating them into request URLs. The SQL API endpoint is built as https://account.snowflakecomputing.com/api/v2/statements, so an account value containing /, ? or demotes the intended domai...
PT-2026-102442
A vulnerability was identified in Rebuild up to 4.4.7/4.5.0-beta5. This affects an unknown part of the file /user/login of the component Login Endpoint. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit is publicly available and might b...
PT-2026-102864
Dockhand before 1.0.36 contains an open redirect vulnerability in the OIDC initiation endpoint that allows unauthenticated remote attackers to redirect authenticated users to attacker-controlled sites by injecting an unvalidated redirect query parameter. Attackers can craft a malicious link...
CVE-2026-8067: Missing Authorization
An improper authorization vulnerability in the end-of-life versions of RTU500’s web application allows an authenticated user to trigger the RTU500 to reboot through the reset endpoint. Successful exploitation could cause temporary device unavailability and disruption of its intended operation...
CVE-2026-79403: Improper Handling of Insufficient Permissions or Privileges
An issue in Kilo Code before v7.4.1 allows a local attacker to execute arbitrary code via the permission/allow-everything endpoint...
CVE-2026-76733: Uncontrolled Resource Consumption
A denial-of-service vulnerability exists in the API endpoint of HPE Networking Instant On that could allow an authenticated attacker with administrative privileges to cause a denial of service. Successful exploitation could allow an attacker to interrupt the normal operation of the affected...
PT-2026-102877
A denial-of-service vulnerability exists in the API endpoint of HPE Networking Instant On that could allow an authenticated attacker with administrative privileges to cause a denial of service. Successful exploitation could allow an attacker to interrupt the normal operation of the affected...
CVE-2026-76728: Server-Side Request Forgery (SSRF)
A vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery SSRF attack. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the...
PT-2026-102907
Name of the Vulnerable Software and Affected Versions Toptech TMS7 versions prior to 7.8 Description An unauthenticated attacker can export arbitrary database tables by sending a crafted POST request to the file export endpoint. Recommendations Upgrade Toptech TMS7 to version 7.8...
PT-2026-102870
🚨 CVE-2026-76726 An authentication bypass vulnerability in the API endpoint of HPE Networking Instant ON could allow an unauthenticated remote attacker to bypass network access controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an...
CVE-2026-102248: Improper Authentication
A vulnerability was identified in Rebuild up to 4.4.7/4.5.0-beta5. This affects an unknown part of the file /user/login of the component Login Endpoint. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit is publicly available and might b...
CVE-2026-53989: URL Redirection to Untrusted Site
Dockhand before 1.0.36 contains an open redirect vulnerability in the OIDC initiation endpoint that allows unauthenticated remote attackers to redirect authenticated users to attacker-controlled sites by injecting an unvalidated redirect query parameter. Attackers can craft a malicious link...
PT-2026-102440
A weakness has been identified in MODSetter SurfSense up to 2.0.3. The affected element is an unknown function of the file surfsense backend/app/routes/circleback webhook route.py of the component circleback Endpoint. Executing a manipulation can lead to missing authentication. The attack can be...
PT-2026-102873
🚨 CVE-2026-76729 A format string vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to cause memory corruption with a modified input. Successful exploitation could allow an attacker to provoke a denial-of-service...