155957 matches found
bola-CVE-2023-27524
bola-CVE-2023-27524 📄 README.md — BOLA CVE-2023-27524 Demo Project 🔐 Broken Object Level Authorization BOLA Demonstration CVE-2023-27524 Security Analysis & Fix --- 📌 Project Overview This project demonstrates a real-world Broken Object Level Authorization BOLA vulnerability and its secure...
CVE-2026-105133 Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication
A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack...
CVE-2026-105133
A vulnerability exists in Ahsay AhsayCBS versions up to 10.3.2 within the API component. The flaw is located in the checkSysPwd function of the file com/ahsay/obs/api/ApiStructsAction.java, where manipulating the random argument leads to improper authentication . This issue can be exploited remot...
CVE-2026-105133 Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication
A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack...
EUVD-2026-92079
A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack...
pocketbase-CVE-2026-44166
CVE-2026-44166: PocketBase OAuth2 Account Pre-Hijacking A PocketBase auth collection with OAuth2 enabled lets the client pass a createData object when it signs up. The email inside createData is never checked against the email the OAuth2 provider verified. Anyone with an account on a configured...
Versa Concerto Actuator Endpoint - Authentication Bypass
An authentication bypass vulnerability affected the Spring Boot Actuator endpoints in Versa Concerto due to improper handling of the X-Real-Ip header.Attackers could access restricted endpoints by omitting this header.The issue allowed unauthorized access to sensitive functionality, highlighting...
CVE-2026-105213: Improper Authentication
ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only the individual user's status. Users of a deactivated organization who hold valid credentials, an existing session, or a refresh token can still sign in, create sessions, and...
CVE-2026-105210: Improper Authentication
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enro...
CVE-2026-105222: Improper Certificate Validation
The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets sslverifypeer to FALSE, which is passed to CURLOPTSSLVERIFYPEER. On-path attackers can present any certificate to intercept Google Maps web-service requests...
CVE-2026-105216: Improper Certificate Validation
go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network attackers to impersonate services because the shared TLS helper sets InsecureSkipVerify to true by default. Man-in-the-middle attackers can present any certificate to intercept or modify gRPC...
PT-2026-104645
go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network attackers to impersonate services because the shared TLS helper sets InsecureSkipVerify to true by default. Man-in-the-middle attackers can present any certificate to intercept or modify gRPC...
CVE-2026-105161: Improper Verification of Cryptographic Signature
A flaw has been found in invariant-systems-ai aiir up to 1.7.0. The affected element is an unknown function of the component Policy Gate Handler. Executing a manipulation can lead to improper verification of cryptographic signature. The attack can be executed remotely. It is advisable to upgrade...
CVE-2026-105221: Improper Certificate Validation
The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because httpconnection in lib/gist.rb sets VERIFYNONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth tokens...
CVE-2026-88779: Improper Restriction of Operations within the Bounds of a Memory Buffer
Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28...
PT-2026-104633
Name of the Vulnerable Software and Affected Versions ZITADEL versions 3.x through 3.4.14 ZITADEL versions 4.x through 4.17.0 Description An improper authorization flaw exists during the issuance of passkey or passwordless enrollment codes. The system validates the organization specified in the...
CVE-2026-105218: Improper Certificate Validation
gopay before 1.5.119 disables TLS certificate verification in defaultClient in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider APIs. Attackers can present any certificate to read merchant credentials, signatures and transaction data, and modify payment,...
PT-2026-104619
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in VeronaLabs WP Statistics wp-statistics allows Reflected XSS.This issue affects WP Statistics: from n/a through 14.16.14...
CVE-2026-105209: Missing Authorization
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organization. Attackers with user-write permission in one...
PT-2026-104644
A flaw has been found in invariant-systems-ai aiir up to 1.7.0. The affected element is an unknown function of the component Policy Gate Handler. Executing a manipulation can lead to improper verification of cryptographic signature. The attack can be executed remotely. It is advisable to upgrade...