CVE-2026-87110

The Ops Manager web port is susceptible to uncontrolled resource consumption (CWE-770). An unauthenticated user with network access can repeatedly request specific monitoring endpoints that perform costly operations. Because these endpoints lack rate limiting , the attack can temporarily slow dow...

CVE-2026-87110 Ops Manager Uncontrolled Resource Consumption in Monitoring Endpoints

An unauthenticated user with network access to the Ops Manager web port can repeatedly request monitoring endpoints that perform costly work without rate limiting. This can temporarily slow other traffic served by the same process while requests continue...

Splunk Enterprise 9.4.0 < 9.4.15, 10.0.0 < 10.0.10, 10.2.0 < 10.2.6, 10.4.0 < 10.4.2 (SVD-2026-1001)

The version of Splunk Enterprise installed on the remote host is 9.4.x prior to 9.4.15, 10.0.x prior to 10.0.10, 10.2.x prior to 10.2.6, or 10.4.x prior to 10.4.2. It is, therefore, affected by an improper authorization vulnerability as referenced in the SVD-2026-1001 advisory. A user who does no...

PT-2026-108734

Name of the Vulnerable Software and Affected Versions Ops Manager affected versions not specified Description An unauthenticated user with network access to the web port can repeatedly request monitoring endpoints that perform resource-intensive operations. Due to a lack of rate limiting, this...

CVE-2026-87110: Allocation of Resources Without Limits or Throttling

An unauthenticated user with network access to the Ops Manager web port can repeatedly request monitoring endpoints that perform costly work without rate limiting. This can temporarily slow other traffic served by the same process while requests continue...

CVE-2026-87109: Insertion of Sensitive Information Into Sent Data

An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's enrollment is unconfirmed. This results in disclosure of secret authentication material to another member of the same organizatio...

CVE-2026-107831

Jivejdon through 5.0 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-changing actions by abusing GET endpoints lacking anti-CSRF tokens. Attackers can lure authenticated users to crafted links targeting /account/protected/delAll,...

CVE-2026-107831

The software Jivejdon (through version 5.0 ) is vulnerable to a cross-site request forgery (CSRF) vulnerability. The root cause is the presence of GET endpoints that lack anti-CSRF tokens, allowing remote attackers to perform state-changing actions. By luring authenticated users into clicking cra...

mig

MIG: Mozilla InvestiGator MIG es la plataforma de Mozilla para la investigación quirúrgica de endpoints remotos. ⚠️ Aviso de desuso ⚠️ Mozilla ya no mantiene el proyecto Mozilla InvestiGator MIG. Mozilla tampoco utiliza este código internamente. Eres bienvenido a usar este código tal cual, sin...

CVE-2026-107604 Keycloak-services: keycloak-services: view-clients role allows retrieval of active client secrets via installation provider endpoints

A flaw was found in the installation provider and client registration endpoints of the Keycloak identity management service. A realm administrator with only the read-only view-clients role can access the active primary secret of any confidential client, which should normally be restricted. This...

Vulnerabilities in Cisco License On-Prem

Cisco has identified several vulnerabilities in Cisco License On-Prem. These vulnerabilities reside in the web-based management interface and API endpoints of Cisco License On-Prem. Unauthorized attackers can reset passwords, write files, or create DoS conditions. Authorized attackers with...

CVE-2026-87426

An unauthenticated network-based attacker can query specific internal management endpoints on Brocade ASCG versions before 3.5.0 to enumerate the configuration details and state of managed Brocade Fabric OS FOS switches. This results in the unauthorized disclosure of the customer's SAN fabric...

PT-2026-108265

Name of the Vulnerable Software and Affected Versions Jivejdon versions prior to 5.1 Description Cross-site request forgery CSRF occurs when an attacker tricks an authenticated user into performing unwanted actions. The software allows remote attackers to execute state-changing actions by abusing...

PT-2026-108191

Name of the Vulnerable Software and Affected Versions Indico versions prior to 3.3.13 Description Indico allows event organizers to submit crafted URLs that bypass validation filters to point to prohibited local targets, such as localhost or cloud metadata endpoints. This occurs because a previou...

CVE-2026-107333: Incorrect Authorization

Malcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based role-based access control RBAC authorization layer and nginx's own request routing logic. An authenticated user can craft a specially formatted request path to bypass role-based restrictions...

CVE-2026-76264

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could create or edit scripted lookup definitions through raw configuration endpoints. The vulnerability is possible because raw transforms configuration write path...

CVE-2026-76265 Improper Access Control through REST API Endpoints in Splunk Secure Gateway

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, a user who does not hold the "admin" or "power" Splunk roles could access privileged Splunk Secure Gateway functionality. With this access, the user could...

EUVD-2026-94616

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could create or edit scripted lookup definitions through raw configuration endpoints. The vulnerability is possible because raw transforms configuration write path...

CVE-2026-76264 Improper Authorization through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could create or edit scripted lookup definitions through raw configuration endpoints. The vulnerability is possible because raw transforms configuration write path...

CVE-2026-76264

Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15 are vulnerable to an improper authorization flaw via the REST API. An attacker with low-level privileges (not holding admin or power roles) can create or edit scripted lookup definitions using raw configuration endpoints. This i...