117543 matches found
CentOS Linux 6 [TuxCare] Security Update: emacs-git / emacs-git-el / git / git-all / git-cvs / git-daemon / etc (CENTOS6:CLSA-2025:1752748974)
The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2025:1752748974 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900...
PT-2026-103991
Name of the Vulnerable Software and Affected Versions GetSimple CMS versions prior to 1.5 Description The UpdateCE update form lacks anti-CSRF tokens, and the POST handler does not verify tokens or request origins. This allows a remote attacker to host a page that auto-submits a forged POST reque...
PT-2026-103968
Podgrab contains a missing authentication vulnerability in which the /ws WebSocket route is registered on the root gin engine instead of the BasicAuth-protected router group, allowing unauthenticated network clients to connect even when PASSWORD is configured. Attackers can join the allConnection...
PT-2026-103983
Name of the Vulnerable Software and Affected Versions Joyland AI affected versions not specified Description The application fails to validate TLS certificates from servers, allowing it to accept any certificate regardless of its authenticity. This lack of validation can enable man-in-the-middle...
PT-2026-104058
Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the HTTP metadata server /metadata handler that allows unauthenticated attackers to read, overwrite, and delete transfer engine metadata keys. Attackers can poison segment descriptors such as tcp data port or re-crea...
CVE-2026-104181: Missing Authentication for Critical Function
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.13.3 and 5.8.3, app-based multi-factor authentication management actions do not consistently require confirmation of the current password. An attacker with access to an authenticated user...
CVE-2026-104058: Missing Authentication for Critical Function
Podgrab contains a missing authentication vulnerability in which the /ws WebSocket route is registered on the root gin engine instead of the BasicAuth-protected router group, allowing unauthenticated network clients to connect even when PASSWORD is configured. Attackers can join the allConnection...
CVE-2026-13043: Missing Authentication for Critical Function
A missing authentication vulnerability in the Kernel Memory Access Driver PSKMAD used by WatchGuard endpoint security products allows a local, authenticated attacker to bypass the driver's access-control handshake and issue arbitrary privileged commands to the driver, resulting in disclosure of...
CVE-2026-66249: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
iControl is affected by a Missing Secure Attribute vulnerability, which could allow an attacker to intercept cookies transmitted over unencrypted HTTP connections, enabling the unauthorized extraction of sensitive information such as session identifiers...
CVE-2026-62063: Missing Authorization
Missing Authorization vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through 2.3.1...
CVE-2026-103341: Missing Authorization
Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Unlimited Elements For Elementor Free Widgets,...
CVE-2026-103539: Missing Authentication for Critical Function
A weakness has been identified in ZongXR SuperMarket 1.0.0.0. This affects the function startBuy of the file instant-buy/src/main/java/com/supermarket/instantbuy/controller/InstantBuyController.java of the component Instant Buy. Executing a manipulation of the argument Username can lead to missin...
CVE-2026-103538: Missing Authentication for Critical Function
A security flaw has been discovered in ZongXR SuperMarket 1.0.0.0. Affected by this issue is the function OrderController.deleteOrder of the file order/src/main/java/com/supermarket/order/controller/OrderController.java of the component Order Deletion Endpoint. Performing a manipulation of the...
PT-2026-103867
iControl is affected by a Missing Secure Attribute vulnerability, which could allow an attacker to intercept cookies transmitted over unencrypted HTTP connections, enabling the unauthorized extraction of sensitive information such as session identifiers...
PT-2026-103684
Name of the Vulnerable Software and Affected Versions Hitachi Coding Software Suite versions prior to 3.3.0 Description Missing Authentication for Critical Function allows an unauthenticated attacker to invoke a critical API. This could lead to unauthorized manipulation or the retrieval and...
PT-2026-103853
Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Unlimited Elements For Elementor Free Widgets,...
PT-2026-103852
Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Reviews: from n/a through 8.3.2...
PT-2026-103705
The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync...
PT-2026-103802
Name of the Vulnerable Software and Affected Versions Ghost versions 5.3.0 through 6.61.0 Description An authorization flaw allows an authenticated site member to read excerpts of posts they are not permitted to access, specifically affecting gated content. Recommendations Update Ghost to version...