109233 matches found
EUVD-2026-48602
Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network...
Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller
Researchers H0j3n and Aniq Fakhrul published a working exploit on July 24 that lets a low-privileged Active Directory user obtain a certificate for a Domain Controller and authenticate as that machine. They codenamed the flaw Certighost. Because Domain Controller accounts carry directory...
Improper Encoding or Escaping of Output
Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output through the HTML encoding. An attacker can execute arbitrary code by supplying specially crafted input that is not properly sanitized. Remediation A fix was pushed into the master branch but not y...
EUVD-2026-48599
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Polen Media Software and Information Services Website Template allows Reflected XSS. This issue affects Website Template: before v2...
CVE-2026-8308
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Polen Media Software and Information Services Website Template allows Reflected XSS. This issue affects Website Template: before v2...
CVE-2026-12504
Loytec LINX firmware (LINX-A64) products LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD are affected by an Improper Authentication (CWE-287) in PAM configuration through 8.4.16. The root cause is improper PAM authentication that allows a local attacker to authenticate as uid=0 w...
CVE-2026-12503
Improper Link Resolution CWE-59 in /usr/bin/larmstarter in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an authenticated larmapp attacker to make /etc/passwd writable by the larmapp group leading to root privilege escalation via a symlink attack on...
CVE-2026-12502
Loytec LINX firmware (LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD) through version 8.4.16 on LINX-A64 suffers CWE-269 due to improper privilege management in /usr/bin/ltsudo. The issue allows a user in the superadmin group to reset any LARM user password (including the larmapp s...
CVE-2026-7484 Improper Access Control in Abis Technology's AVESİS
External control of Assumed-Immutable web parameter vulnerability in ABIS Technology Ltd. Co. AVESİS allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects AVESİS: before 202606251646...
CVE-2026-7484
CVE-2026-7484 affects AVESİS (ABIS Technology Ltd. Co.). Description: External control of an Assumed-Immutable web parameter vulnerability allowing access to functionality not properly constrained by ACLs. Affected versions: before 202606251646. Impact per provided metrics: CVSS 3.1 base score 5....
EUVD-2026-48454
Improper authorization in Azure Red Hat OpenShift ARO allows an authorized attacker to elevate privileges over a network...
EUVD-2026-48453
Improper input validation in Microsoft Surface allows an authorized attacker to execute code over a network...
CVE-2026-62825
Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-56191
Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network...
CVE-2026-54120
Improper input validation in Microsoft Surface allows an authorized attacker to execute code over a network...
CVE-2026-35425
Improper access control in Azure API Management APIM allows an authorized attacker to execute code over a network...
CVE-2026-62825
Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network...
EUVD-2026-48459
Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network...