MINI-PPPW-6JRW-8WXR

Bulletin has no description...

Doczilla Document Automation XSS

The vulnerability of the Doczilla document automation development program is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

SenseLive X3050 访问控制错误漏洞

The SenseLive X3050 is a data collection and environmental monitoring device designed for IoT scenarios by SenseLive Corporation. The SenseLive X3050 has a access control vulnerability, which stems from the lack of authentication or authorization in the embedded management services. This...

CVE-2026-40182: Memory Allocation with Excessive Size Value

OpenTelemetry dotnet is a dotnet telemetry framework. From 1.13.1 to before 1.15.2, When exporting telemetry to a back-end/collector over gRPC or HTTP using OpenTelemetry Protocol format OTLP, if the request results in a unsuccessful request i.e. HTTP 4xx or 5xx, the response is read into memory...

CVE-2026-40586: Improper Restriction of Excessive Authentication Attempts

blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, the login form handler performs no throttling of any kind. Failed authentication attempts are processed at full network speed with no IP-based rate limiting, no per-account attempt counter, no temporary lockout, no progressiv...

Apache Airflow Authentication Bypass

The vulnerability of the Apache Airflow network software is related to the lack of authentication. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to the HITL processes...

XWiki Platform Auth Bypass

The vulnerability of the XWiki Platform, a platform for creating collaborative web applications, lies in the lack of authentication. Exploiting this vulnerability allows a malicious actor to manipulate the integrity, accessibility, and confidentiality of information...

Remote Desktop Licensing Service Privilege Escalation

The vulnerability of the Remote Desktop Licensing Service for Windows operating systems is related to the lack of authentication for a critical function. Exploiting this vulnerability can allow attackers to increase their privileges...

Honeywell CCTV Authentication Bypass

The vulnerability of Honeywell CCTV video surveillance software lies in the lack of authentication for critical functions. Exploiting this vulnerability could allow an intruder to gain unauthorized access to protected information...

PT-2026-33903

Summary The system log endpoints GET /api/system/logs, GET /api/system/logs/stream, WS /ws/system/logs lack authorization checks, allowing any authenticated non-admin user to read and stream all server logs. These logs contain error stack traces, internal file paths, module names, and arbitrary...

Fortinet FortiClient Enterprise Management Server Command Execution

The vulnerability of the application software interface of the Fortinet FortiClient Enterprise Management Server EMS lies in the lack of access control mechanisms. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands by sending specially crafted requests...

WWBN AVideo 信息泄露漏洞

WWBN AVideo is a video platform building system written in PHP, developed by the WWBN team. Versions of WWBN AVideo prior to version 26 contain an information leakage vulnerability. This vulnerability stems from the lack of authentication mechanisms, which may lead to information leaks...

DEBIAN-CVE-2026-23449

In the Linux kernel, the following vulnerability has been resolved: net/sched: teql: Fix double-free in teqlmasterxmit Whenever a TEQL devices has a lockless Qdisc as root, qdiscreset should be called using the seqlock to avoid racing with the datapath. Failure to do so may cause crashes like the...

Ech0: Unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata

Summary The GET /api/website/title endpoint accepts an arbitrary URL via the websiteurl query parameter and makes a server-side HTTP request to it without any validation of the target host or IP address. The endpoint requires no authentication. An attacker can use this to reach internal network...

Cisco EPNM Web Interface Compromise

The vulnerability of the Web interface for managing Cisco Evolved Programmable Network Manager EPNM software lies in the lack of authentication. Exploiting this vulnerability allows a malicious actor to compromise the vulnerable device remotely...

Microsoft Azure MCP Server 访问控制错误漏洞

Microsoft Azure MCP Server is a core server component developed by Microsoft Corporation in the United States, used for managing and coordinating services and resources on the Azure cloud platform. There is an access control vulnerability in Microsoft Azure MCP Server; this vulnerability stems fr...

CVE-2026-33580

OpenClaw before 2026.3.28 contains a missing rate limiting vulnerability in the Nextcloud Talk webhook authentication that allows attackers to brute-force weak shared secrets. Attackers who can reach the webhook endpoint can exploit this to forge inbound webhook events by repeatedly attempting...

PT-2026-32136

Summary The revoke key method in openssl encrypt server/modules/keyserver/service.py at lines 195-270 accepts a client id parameter but never verifies that the requesting client is the same as key.owner client id. Impact Any authenticated client can revoke any other client's key, as long as they...

CVE-2026-34872: Improper Verification of Cryptographic Signature

An issue was discovered in Mbed TLS 3.5.x and 3.6.x through 3.6.5 and TF-PSA-Crypto 1.0. There is a lack of contributory behavior in FFDH due to improper input validation. Using finite-field Diffie-Hellman, the other party can force the shared secret into a small set of values lack of contributor...

PT-2026-32071

Severity: HIGH Summary The TOTP brute-force rate limiter in openssl encrypt server/modules/pepper/totp.py at lines 47-98 uses an in-memory defaultdictlist as a class variable. Affected Code python class TOTPRateLimiter: def init self, ...: self.attempts: Dictstr, Listdatetime = defaultdictlist...