22583 matches found
EUVD-2026-62540
Grav: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge...
CVE-2026-84292
fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject authority delimiters, demoting the intended host t...
CVE-2026-12704 SAML assertion replay via skipped InResponseTo validation
When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and ga...
EUVD-2026-70197
When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and ga...
PT-2026-84647
TRC analysis shows attackers exploiting CVE-2024-26225 authentication bypass on 22,000 unpatched Exchange servers to hijack all user mailboxes. Post-compromise lateral movement through stolen email credentials enables widespread organizational infiltration. Runtime segmentation helps contain brea...
Rockwell FactoryTalk Activation Manager <= 5.02 Privilege Escalation (SD1799)
The version of Rockwell FactoryTalk Activation Manager installed on the remote Windows host is 5.02 or prior. It is, therefore, affected by a privilege escalation vulnerability. The security issue stems from custom actions in the installer that spawn visible console windows running with SYSTEM...
DLLHijackHunter v2.4.0
DLLHijackHunter By ProjectMerai Automated DLL Hijacking Discovery, Validation, and Confirmation Turning local misconfigurations into weaponized, confirmed attack paths. Overview DLLHijackHunter is an automated Windows DLL hijacking detection tool that goes beyond static analysis. It discovers,...
NLTK: Uncontrolled search path when invoking the Graphviz 'dot' binary
Two NLTK sites executed the Graphviz dot program by bare name, so process creation resolved it via the search path — and on Windows via the current working directory — rather than a validated absolute location. An attacker who can place a file named dot where resolution looks the CWD on Windows, ...
Security Bulletin: Multiple vulnerabilities found in spring-boot-3.3.11.jar - part of IBM webMethods API Management
Summary Multiple vulnerabilities found in spring-boot-3.3.11.jar - part of IBM webMethods API Management have been addressed Vulnerability Details CVEID:CVE-2026-40973 DESCRIPTION: A local attacker on the same host as the application may be able to take control of the directory used by...
CVE-2026-9634
A security issue exists within the Redundancy Module Configuration Tool. The RMConfigTool.exe binary searches directories in the system path for a required DLL, and one or more of these directories may be writable by standard non-administrator users due to incorrect default permissions. If a loca...
CVE-2026-9633
A security issue exists within the Redundancy Module Configuration Tool. The RM3ConfigTool.exe binary searches directories in the system path for a required DLL, and one or more of these directories may be writable by standard non-administrator users due to incorrect default permissions. If a loc...
CVE-2026-9634 Redundancy Module Configuration Tool - Multiple Vulnerabilities
A security issue exists within the Redundancy Module Configuration Tool. The RMConfigTool.exe binary searches directories in the system path for a required DLL, and one or more of these directories may be writable by standard non-administrator users due to incorrect default permissions. If a loca...
CVE-2026-9634 Redundancy Module Configuration Tool - Multiple Vulnerabilities
A security issue exists within the Redundancy Module Configuration Tool. The RMConfigTool.exe binary searches directories in the system path for a required DLL, and one or more of these directories may be writable by standard non-administrator users due to incorrect default permissions. If a loca...
EUVD-2026-69148
A security issue exists within the Redundancy Module Configuration Tool. The RMConfigTool.exe binary searches directories in the system path for a required DLL, and one or more of these directories may be writable by standard non-administrator users due to incorrect default permissions. If a loca...
EUVD-2026-69147
A security issue exists within the Redundancy Module Configuration Tool. The RM3ConfigTool.exe binary searches directories in the system path for a required DLL, and one or more of these directories may be writable by standard non-administrator users due to incorrect default permissions. If a loc...
CVE-2026-9633 Redundancy Module Configuration Tool - Multiple Vulnerabilities
A security issue exists within the Redundancy Module Configuration Tool. The RM3ConfigTool.exe binary searches directories in the system path for a required DLL, and one or more of these directories may be writable by standard non-administrator users due to incorrect default permissions. If a loc...
CVE-2026-9633 Redundancy Module Configuration Tool - Multiple Vulnerabilities
A security issue exists within the Redundancy Module Configuration Tool. The RM3ConfigTool.exe binary searches directories in the system path for a required DLL, and one or more of these directories may be writable by standard non-administrator users due to incorrect default permissions. If a loc...
CVE-2026-9633
CVE-2026-9633 affects Rockwell Automation's Redundancy Module Configuration Tool . The RM3ConfigTool.exe binary searches directories in the system path for a required DLL, but due to incorrect default permissions , one or more of these directories may be writable by standard (non-administrator) u...
CVE-2026-16675
A privilege escalation vulnerability exists in Rockwell Automation FactoryTalk® Activation Manager . The root cause is custom installer actions that spawn visible console windows running with SYSTEM privileges during installation or repair operations. An authenticated attacker holding valid Windo...
EUVD-2026-69128
A privilege escalation security issue exists within FactoryTalk® Activation Manager. The security issue stems from custom actions in the installer that spawn visible console windows running with SYSTEM privileges during installation or repair operations. An authenticated attacker with Windows...