3521 matches found
CVE-2026-51078
An issue in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the str parameter of the filemanagecontrol.php component...
PT-2026-65090
Name of the Vulnerable Software and Affected Versions Ekushey Project Manager CRM versions prior to 5.1 Description A stored cross-site scripting issue exists where authenticated client users can inject arbitrary HTML and JavaScript. This occurs when malicious payloads are entered into the Name...
CVE-2026-51078
An issue in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the str parameter of the filemanagecontrol.php component...
PT-2026-65304
Name of the Vulnerable Software and Affected Versions Dede CMS version 5.7.118 Description A remote attacker can obtain sensitive information through the 'file manage control.php' component by manipulating the str parameter. Recommendations At the moment, there is no information about a newer...
The vulnerability of the ManageSieve mail server services Dovecot and OX Dovecot Pro, related to uncontrolled resource consumption, allows attackers to cause service failures.
The vulnerability of the ManageSieve mail server services Dovecot and OX Dovecot Pro is related to an uncontrolled consumption of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures...
Plone < 5.2.3 Multiple Vulnerabilities
The version of Plone installed on the remote host is prior to 5.2.3. It is, therefore, affected by the following vulnerabilities: - Plone allows XXE attacks via a feature that is explicitly only available to the Manager role. CVE-2020-28734 - Plone allows SSRF attacks via the tracebacks feature...
Critical: Red Hat Security Advisory: Migration Toolkit for Applications
A new version of Migration Toolkit for Applications MTA is now available. Migration Toolkit for Applications MTA accelerates large-scale application modernization efforts across hybrid cloud environments on Red Hat OpenShift. This solution provides insight throughout the adoption process, at both...
CVE-2025-71388 stoatchat 20241213-1 Webhook Token Disclosure via Read Permissions
stoatchat delta/Revolt versions from 20241213-1 before 20250210-1 allow users with only ViewChannel read permission on a channel to fetch that channel's webhooks, including their tokens, because the webhook fetch endpoint checked for ViewChannel instead of ManageWebhooks. Using a retrieved token,...
CVE-2026-45419 DataEase: Arbitrary File Write Vulnerability
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase template saves call TemplateManageServicesave, StaticResourceServersaveFilesToServe, and the /de2api/templateManage/save endpoint with attacker-controlled staticResource names and Base64 content, allowing...
CVE-2026-5269
In Ciena's Navigator Network Control Suite NCS and Manage Control Plan MCP, there are hidden system accounts used for internal software operations. Some of these accounts have default passwords that may be predictable. While these accounts have very limited permissions on their own, an attacker...
CVE-2026-5269
Technical details about CVE-2026-5269 are not publicly available in the provided documents; no affected product versions, exploit information, or remediation specifics are included. Monitor for updates.
CVE-2026-5269 Navigator NCS and MCP System Accounts with Default Passwords
In Ciena's Navigator Network Control Suite NCS and Manage Control Plan MCP, there are hidden system accounts used for internal software operations. Some of these accounts have default passwords that may be predictable. While these accounts have very limited permissions on their own, an attacker...
CVE-2026-5269
In Ciena's Navigator Network Control Suite NCS and Manage Control Plan MCP, there are hidden system accounts used for internal software operations. Some of these accounts have default passwords that may be predictable. While these accounts have very limited permissions on their own, an attacker...
CVE-2026-5270 Authentication Bypass in Navigator and Blue Planet Products
An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite NCS, Manage Control Plan MCP, and Blue Planet products. The issue is caused by improper handling of HTTP request paths and headers, which allows an unauthenticated attacker to manipulate...
CVE-2026-5270
An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite NCS, Manage Control Plan MCP, and Blue Planet products. The issue is caused by improper handling of HTTP request paths and headers, which allows an unauthenticated attacker to manipulate...
CVE-2026-9824
Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4, 10.11.x = 10.11.19 fail to check the managesharedchannels permission in the /share-channel autocomplete handler, which allows an authenticated user without that permission to enumerate configured remote cluster connection metadata via slash...
CVE-2026-57715
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPManageNinja Fluent CRM fluent-crm allows Reflected XSS.This issue affects Fluent CRM: from n/a through = 3.1.7...
CVE-2026-12994 WCFM – Frontend Manager for WooCommerce <= 6.7.27 - Missing Authorization to Unauthenticated Arbitrary Inquiry Reply Injection via wcfm-my-account-enquiry-manage Controller
The WCFM – Frontend Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.7.27. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attacker...
[SECURITY] Fedora 43 Update: k9s-0.51.0-2.fc43
Kubernetes CLI To Manage Your Clusters In Style!...
PYSEC-2026-2882 Improper Restriction of XML External Entity Reference in Plone
Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata therefore, only available to the Manager role...