5004 matches found
CVE-2026-28806 Improper authorization in device bulk actions and device update API allows cross-organization device control
Improper Authorization vulnerability in nerves-hub nerveshubweb allows cross-organization device control via device bulk actions and device update API. Missing authorization checks in the device bulk actions and device update API endpoints allow authenticated users to target devices belonging to...
EEF-CVE-2026-28806 Improper authorization in device bulk actions and device update API allows cross-organization device control
Summary Improper Authorization vulnerability in nerves-hub nerves\hub\web allows cross-organization device control via device bulk actions and device update API. Missing authorization checks in the device bulk actions and device update API endpoints allow authenticated users to target devices...
CVE-2026-28806
Improper Authorization vulnerability in nerves-hub nerveshubweb allows cross-organization device control via device bulk actions and device update API. Missing authorization checks in the device bulk actions and device update API endpoints allow authenticated users to target devices belonging to...
CVE-2026-3854 Remote code execution via git push option injection in GitHub Enterprise Server
An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Server that allowed an attacker with push access to a repository to achieve remote code execution on the instance. During a git push operation, user-supplied push option values were not properly...
PT-2026-24471
Name of the Vulnerable Software and Affected Versions nerves-hub nerves hub web versions 1.0.0 through 2.3.9 Description An improper authorization issue exists in nerves-hub nerves hub web that allows cross-organization device control through device bulk actions and the device update API. Missing...
CVE-2026-28678
DSA Study Hub is an interactive educational web application. Prior to commit d527fba, the user authentication system in server/routes/auth.js was found to be vulnerable to Insufficiently Protected Credentials. Authentication tokens JWTs were stored in HTTP cookies without cryptographic protection...
EUVD-2026-10157
DSA Study Hub is an interactive educational web application. Prior to commit d527fba, the user authentication system in server/routes/auth.js was found to be vulnerable to Insufficiently Protected Credentials. Authentication tokens JWTs were stored in HTTP cookies without cryptographic protection...
CVE-2026-28678
Further research determined the issue is not a vulnerability...
CVE-2026-28678 dsa-hub-server: Clear-Text Storage of Sensitive Data
DSA Study Hub is an interactive educational web application. Prior to commit d527fba, the user authentication system in server/routes/auth.js was found to be vulnerable to Insufficiently Protected Credentials. Authentication tokens JWTs were stored in HTTP cookies without cryptographic protection...
CVE-2026-28678
...
CVE-2026-28678
CVE-2026-28678 pertains to the DSA Study Hub application. Prior to commit d527fba, the authentication system in server/routes/auth.js stored JWTs in HTTP cookies without cryptographic protection of the payload, exposing credential data via insufficiently protected credentials. The issue affects t...
DSA Study Hub 安全漏洞
DSA Study Hub is an interactive data structure and algorithm learning platform developed by toxicbishop, a personal developer. Previous versions of DSA Study Hub d527fba had security vulnerabilities. These vulnerabilities stemmed from the fact that authentication tokens were stored in HTTP cookie...
PT-2026-23866
Name of the Vulnerable Software and Affected Versions DSA Study Hub versions prior to commit d527fba Description The user authentication system in the application’s server/routes/auth.js component had a flaw related to insufficiently protected credentials. Authentication tokens, specifically JWTs...
Incomplete List of Disallowed Inputs
Overview sagemaker-core is an An python package for sagemaker core functionalities Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via the searchhub function. An attacker can execute arbitrary commands, access sensitive data, or compromise the execution...
Moderate: Red Hat Security Advisory: Red Hat Developer Hub 1.9.0 release.
Red Hat Developer Hub 1.9.0 has been released. Red Hat Developer Hub RHDH is Red Hat's enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters AKS, EKS, GKE. The core features of RHDH include a single...
Telegram Increasingly Used to Sell Access, Malware and Stolen Logs
Cybercriminals are now increasingly using Telegram to sell corporate access, malware subscriptions, and stealer logs, turning the messaging app into a fast cybercrime hub...
CVE-2026-26892
Sourcecodester Logistic Hub Parcel's Management System v1.0 is vulnerable to SQL Injection in /managecarrier.php...
CVE-2026-26891
Sourcecodester Logistic Hub Parcel's Management System v1.0 is vulnerable to SQL Injection in /manageparceltype.php...
