59439 matches found
CVE-2026-75832: Missing Authorization
The Grav API plugin getgrav/grav-plugin-api, bundled with Grav 2.0 before version 1.0.14 fixed in 1.0.15 contains a missing authorization vulnerability in BlueprintPathResolver::resolveUserScope. The method gates the users/ scope on the account's raw super-admin ACL flag access.api.super instead ...
CVE-2026-75626: Improper Neutralization of Input During Web Page Generation
SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is...
PT-2026-76935
Name of the Vulnerable Software and Affected Versions Grav API plugin getgrav/grav-plugin-api versions prior to 1.0.14 Description An issue exists in the userPassesAuthorize function within AbstractApiController.php where the system fails to verify the API key scopes of the calling request...
PT-2026-76959
Name of the Vulnerable Software and Affected Versions Zabbix version 7.4 Description The cryptographic key used for signing Frontend sessions is incorrectly written to the database seed. This issue affects deployments that simultaneously use SAML authentication and guest users, allowing the key t...
PT-2026-77025
Name of the Vulnerable Software and Affected Versions EdoWEB versions prior to 780-g7 Description An authorization bypass exists in Netiket Information Technologies EdoWEB due to a user-controlled key, which allows access to functionality that is not properly constrained by Access Control Lists...
PT-2026-77166
Name of the Vulnerable Software and Affected Versions CodeWhale versions prior to 0.8.64 Description The js execution tool fails to scrub parent process environment variables before spawning Node.js. This allows attackers to execute malicious JavaScript code that reads process.env to leak sensiti...
PT-2026-77147
Name of the Vulnerable Software and Affected Versions Copyparty versions prior to 1.20.17 Description When the dk or dks directory-key flags are combined with the fk or fka file-key flags in a volume, a valid file key can be converted into a directory key. This allows unauthorized read access to...
PT-2026-77225
Name of the Vulnerable Software and Affected Versions Submariner operator affected versions not specified Description A flaw exists in the Submariner operator where the Submariner Custom Resource CR, used for network connectivity configuration, stores the IPsec pre-shared key PSK in an unencrypte...
Linux Distros Unpatched Vulnerability : CVE-2026-72103
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: dm: avoid leaking the caller's thread keyring via the table device file The refactoring in...
Linux Distros Unpatched Vulnerability : CVE-2026-72049
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ieee802154: admin-gate legacy LLSEC dump operations In net/ieee802154/netlink.c, the legacy IEEE802154NL family ops table builds the LLSEC dump entries...
PT-2026-82773
Name of the Vulnerable Software and Affected Versions Wazuh versions 4.14.0 through 4.14.6 Description An authenticated low-privilege user can read the cluster secret from the manager configuration. This occurs because the logic used to mask sensitive values is disabled whenever any update-config...
PT-2026-76932
Name of the Vulnerable Software and Affected Versions Grav API plugin versions prior to 1.0.15 Description An authorization bypass exists in the BlueprintPathResolver::resolveUserScope function. The system checks the account's super-admin ACL flag access.api.super instead of validating the actual...
PT-2026-77251
Name of the Vulnerable Software and Affected Versions Wazuh versions 4.0.0 through 4.14.5 Description An issue exists where authenticated cluster peers can delete arbitrary directory contents within the installation path writable by the wazuh user. This occurs because the system fails to validate...
CVE-2026-71317: Missing Authorization
Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/authorities with type=subca did not require AuthorityPermission on the parent authority when ADMINONLYAUTHORITYCREATION was false. AssociatedAuthoritySchema resolved the caller-supplied parent and passed it through authority...
CVE-2026-50577: Reusing a Nonce, Key Pair in Encryption
ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration leaves requestcounter unchanged in app/vau/VAUProtokoll.py while constructing VAU messages. The frozen client request counte...
CVE-2026-23937: Observable Discrepancy
The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity...
CVE-2026-16309: Authorization Bypass Through User-Controlled Key
Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects EdoWEB: before 780-g7...
CVE-2026-75835: Missing Authorization
Grav API plugin getgrav/grav-plugin-api before 1.0.14 contains a missing authorization vulnerability in userPassesAuthorize AbstractApiController.php. The function fails to consult the calling request's API key scopes, relying instead on the account's raw super-admin flag and ACL grants. As a...
PT-2026-77285
Name of the Vulnerable Software and Affected Versions Lemur versions prior to 1.9.3 Description An issue exists in the CertificateExport process where the ownership check for CertificatePermission was incorrectly placed within the plugin.requires key branch for the 'POST...
