89405 matches found
CVE-2026-72578
A cross-site request forgery CSRF vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticated administrator...
CVE-2026-72577
NASA fprime-gds (through version 3.4.3) contains multiple vulnerabilities that collectively allow unauthenticated remote code execution on the ground station host and the ability to inject commands into connected spacecraft. The Flask application (src/fprime_gds/flask/app.py) applies no authentic...
CVE-2026-72577 NASA fprime-gds - Missing Authentication and Path Traversal Enable Unauthenticated RCE and Spacecraft Command Injection
Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. The Flask application in src/fprimegds/flask/app.py applies no authentication to...
CVE-2026-72576 Bludit - Stored Cross-Site Scripting via Malicious SVG Logo Upload
A stored cross-site scripting XSS vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user Author role to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. A stored script tag in the SVG executes in the browser of any user who loads the logo...
CVE-2026-72576
A stored cross-site scripting XSS vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user Author role to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. A stored script tag in the SVG executes in the browser of any user who loads the logo...
CVE-2026-55814
Missing Authentication in Apache Ranger Download APIs on versions = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...
CVE-2026-55814 Apache Ranger: Download APIs expose plugin data without authentication
Missing Authentication in Apache Ranger Download APIs on versions = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...
CVE-2026-55814
CVE-2026-55814 associates a missing-authentication flaw in the Apache Ranger Download APIs for versions ≤ 2.8.0, potentially exposing plugin data. The issue is mitigated by upgrading to version 2.9.0, which is stated as fixing the vulnerability. Exploitation details or in‑the‑wild status are not ...
EUVD-2026-55248
Missing Authentication in Apache Ranger Download APIs on versions = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...
AZL-95583 CVE-2026-19404 affecting package 389-ds-base 3.1.1-11
A flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations perform no authorization check, allowing an unauthenticated remote attacker to invoke them when nsslapd-allow-anonymous-access is enabled the default, or any authenticated...
RHSA-2026:52400 Red Hat Security Advisory: python3 security update
Bulletin has no description...
RHSA-2026:52396 Red Hat Security Advisory: postgresql:12 security update
Bulletin has no description...
RHSA-2026:52395 Red Hat Security Advisory: postgresql security update
Bulletin has no description...
RHSA-2026:52389 Red Hat Security Advisory: osbuild-composer security update
Bulletin has no description...
CVE-2026-19404 389-ds-base: 389-ds-base: missing authorization allows anonymous clients to start or abort cleanallruv replication maintenance
A flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations perform no authorization check, allowing an unauthenticated remote attacker to invoke them when nsslapd-allow-anonymous-access is enabled the default, or any authenticated...
CVE-2026-21079
Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept transmitted data...
MINI-W379-Q9VM-X77V
Bulletin has no description...
MINI-VXXQ-X393-RX83
Bulletin has no description...