115883 matches found
EUVD-2026-95259
Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missing authorization vulnerability in the OnlyOffice save callback editUploadOfficeFileById. Unauthenticated attackers can supply arbitrary url and key parameters to make the server...
CVE-2026-107781 Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById
Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missing authorization vulnerability in the OnlyOffice save callback editUploadOfficeFileById. Unauthenticated attackers can supply arbitrary url and key parameters to make the server...
CVE-2026-107779 Dromara Skyeye xxl-job-admin Missing Authentication on Job Endpoints Allows RCE
Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimitlimit = false. Unauthenticated attackers can POST GLUESHELL, GLUEPYTHON, or GLUEPOWERSHELL job...
CVE-2026-107779 Dromara Skyeye xxl-job-admin Missing Authentication on Job Endpoints Allows RCE
Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimitlimit = false. Unauthenticated attackers can POST GLUESHELL, GLUEPYTHON, or GLUEPOWERSHELL job...
EUVD-2026-95257
Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimitlimit = false. Unauthenticated attackers can POST GLUESHELL, GLUEPYTHON, or GLUEPOWERSHELL job...
CVE-2026-107779
The Dromara Skyeye software contains a missing authentication vulnerability in the bundled xxl-job-admin component, specifically within the JobInfoController endpoints annotated with @PermissionLimit(limit = false). This flaw allows unauthenticated attackers to send a POST request to the /jobinfo...
CVE-2026-107395 Indico: Missing access check in legacy session export API
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, an authenticated user can misuse the legacy session export API to retrieve details for a restricted session without access to that session, as long as the containing...
CVE-2026-107395
The event management system Indico is vulnerable to a missing access check in its legacy session export API, used by the Flask-Multipass authentication system. Versions prior to 3.3.13 allow an authenticated user to retrieve details for a restricted session—such as the title, description, and con...
CVE-2026-107395 Indico: Missing access check in legacy session export API
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, an authenticated user can misuse the legacy session export API to retrieve details for a restricted session without access to that session, as long as the containing...
Missing Release of Resource after Effective Lifetime
Overview pydantic-ai-slim is an Agent Framework / shim to use Pydantic with LLMs, slim package Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via ConcurrencyLimitedModel when streaming model responses. A RuntimeError is raised and a...
CVE-2026-104076
TVU Networks Receiver/Transceiver devices running firmware before version 7.9 are vulnerable to a missing authentication flaw in their REST API endpoints on port 8288 . Remote unauthenticated attackers can exploit this to read sensitive device information, including network configurations and fir...
CVE-2026-104076 TVU Networks Receiver/Transceiver Missing Authentication via REST API
TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentication vulnerability that allows remote unauthenticated attackers to read sensitive device information and modify device configuration via unprotected REST API endpoints. Attackers can send...
EUVD-2026-95251
TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentication vulnerability that allows remote unauthenticated attackers to read sensitive device information and modify device configuration via unprotected REST API endpoints on port 8288. Attackers...
CVE-2026-84272 IBM Guardium Data Protection Missing Authentication
IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing authentication in the edge-controller component. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary container images and gain control of managed edge clusters...
CVE-2026-84272
IBM Guardium Data Protection versions 12.1 and 12.2.2 are vulnerable to a missing authentication flaw in the edge-controller component. An unauthenticated remote attacker can exploit this to execute arbitrary container images and seize control of managed edge clusters . No specific exploitation d...
EUVD-2026-95239
IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing authentication in the edge-controller component. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary container images and gain control of managed edge clusters...
CVE-2026-84272 IBM Guardium Data Protection Missing Authentication
IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing authentication in the edge-controller component. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary container images and gain control of managed edge clusters...
EUVD-2026-95236
The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an unusually large data structure can terminate the...
CVE-2026-107325
The MongoDB Go Driver is vulnerable to a denial of service due to improper validation of BSON array lengths. When an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array, it can trigger an out-of-bounds index and a runtime panic . An unauthenticated a...
CVE-2026-33017-Exploit
CVE-2026-33017 - Langflow Unauthenticated RCE / \ | | \ ^ / ||||| exec with no auth, no sandbox, no hope. Langflow chat.py - startflowbuild - buildgraphfromdata - Graph.frompayload - loading.py - eval.py createclass - validate.py prepareglobalscope - execcompiledcode - arbitrary code runs as the...