28020 matches found
CVE-2026-71187
The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacker may generate valid authentication requests and bypass authentication to obtain administrative access to the device...
CVE-2026-61783
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, an authenticated low-privilege user can read the cluster secret from the manager configuration because the logic that masks sensitive values is...
PT-2026-83345
Name of the Vulnerable Software and Affected Versions Klever-Go versions prior to 1.7.19 Description An issue exists in the processPercentageRoyaltiesTransfer function within core/kapp/accounts/accounts.go where the royalty pool is debited from the sender using SubFromBalance only after the split...
CVE-2026-78618
CVE-2026-78618 is a business logic flaw in WatchGuard Dimension that allows an authenticated administrator to trigger multiple backend operations within a single logical flow by sending a specially crafted request. The flaw scores 6.9 (MEDIUM) under CVSS 4.0, with high confidentiality impact on t...
CVE-2026-78618 Dimension Business Logic Flaw Allows Chained Backend Object Operations
A business logic flaw in WatchGuard Dimension allows an authenticated administrator to trigger multiple backend operations within a single logical flow by sending a specially crafted request...
EUVD-2026-67191
Partition interceptor may be improperly added while sending message. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...
CVE-2026-65915
A flaw was found in NLTK. A logic bug in the FileSystemPathPointer.open function allows the sandbox validation check to be bypassed. A remote attacker can exploit this by providing specially crafted file:// Uniform Resource Locators URLs to nltk.data.load. This enables the attacker to read...
PT-2026-82778
The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacker may generate valid authentication requests and bypass authentication to obtain administrative access to the device...
EUVD-2026-66217
Kimai before 2.63.0 contains a business logic / improper authorization vulnerability in the team update API endpoint PATCH /api/teams/id, which removes all existing team members before validating the submitted replacement member list. An authenticated teamlead or other user with permission to edi...
CVE-2026-80563
In the Linux kernel, the following vulnerability has been resolved: gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind The "trigger" debugfs file has a hand-rolled -write handler triggerwrite that dereferences the per-device gpiolapollpriv. The file is created with...
CVE-2026-80563
CVE-2026-80563 is a use-after-free in the Linux kernel's gpio-sloppy-logic-analyzer platform driver. The trigger debugfs file's trigger_write() handler dereferences a per-device structure allocated via devm_kzalloc(). Because the file was created with debugfs_create_file_unsafe(), the full_proxy ...
CVE-2026-80563 gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind
In the Linux kernel, the following vulnerability has been resolved: gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind The "trigger" debugfs file has a hand-rolled -write handler triggerwrite that dereferences the per-device gpiolapollpriv. The file is created with...
CVE-2026-15366
A control logic defect in a specific built-in webpage of Kids Mode allows users to view local gallery photos directly within the page...
CVE-2026-58108
The personal access token removal query selects from PersonalAccessTokenDB but filters on columns of Session, with no join between them. SQLAlchemy resolves that as an implicit cross join, so the filter does not constrain the delete to the calling user's own token in the way the code reads as...
CVE-2026-15365
A pop-up logic flaw in a certain feature of Kids Mode allows users to bypass password verification and use Quick Apps outside the app...
CVE-2026-58108
Ericsson CodeChecker 's personal access token deletion query selects from PersonalAccessTokenDB but filters on Session columns without a join. SQLAlchemy resolves this as an implicit cross join, meaning the filter fails to constrain the delete to the calling user's own token. As a result, a suffi...
CVE-2026-15366
A control logic defect in a specific built-in webpage of Kids Mode allows users to view local gallery photos directly within the page...
CVE-2026-15366
A control logic defect in a specific built-in webpage of Kids Mode on vivo devices allows users to view local gallery photos directly within that page. The vulnerability is scored CVSS 4.0 base 2.4 (LOW) with a physical attack vector , indicating proximity access is required and no privileges or ...