2730 matches found
N-able N-central < 2024.2 - Authentication Bypass Detection
N-central server versions prior to 2024.2 contain an authentication bypass in the user interface, letting attackers access restricted areas without proper credentials, exploit requires no specific conditions. id: CVE-2024-28200 info: name: N-able N-central 2024.2 - Authentication Bypass Detection...
Alt-n/MDaemon Security Gateway <=8.5.0 - XML Injection
Alt-n/MDaemon Security Gateway through 8.5.0 is susceptible to XML injection via SecurityGateway.dll?view=login. An attacker can inject an arbitrary XML argument by adding a new parameter in the HTTP request URL. As a result, the XML parser fails the validation process and discloses information...
Acexy Wireless-N WiFi Repeater REV 1.0 - Repeater Password Disclosure
Acexy Wireless-N WiFi Repeater REV 1.0 is vulnerable to password disclosure because the password.html page of the web management interface contains the administrator account password in plaintext. id: CVE-2021-28937 info: name: Acexy Wireless-N WiFi Repeater REV 1.0 - Repeater Password Disclosure...
WordPress Frontend File Manager < 4.0 & N-Media Post Frontend < 1.1 - Arbitrary File Upload
The Frontend File Manager plugin 4.0 and N-Media Post Front-end Form plugin 1.1 for WordPress were vulnerable to arbitrary file uploads due to missing file type validation. This allowed unauthenticated attackers to upload arbitrary files and potentially achieve remote code execution. id:...
EUVD-2026-52010
An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1...
N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
N-able N-central contains an authentication bypass using an alternate path or channel allows for authentication bypass and account takeover in N-central. This vulnerability is the result of an incomplete patch for CVE-2026-18556...
CVE-2026-18577
An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1...
CVE-2026-18577 Incomplete patch leads to administrative account takeover
An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1...
CVE-2026-18577
CVE-2026-18577 concerns an authentication bypass in N-able N-central resulting from an incomplete patch for CVE-2026-18556. Affected builds include versions through 2026.3.1, with N-able releasing hotfix 2026.3.1.7 to address the issue. Multiple connected sources note that attackers could gain re...
CVE-2026-18556
Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1...
CVE-2026-18556 Unauthenticated administrative account takeover
Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1...
CVE-2026-18556
CVE-2026-18556 affects N-able N-central (through 2026.1) and describes an authentication bypass via an alternate path/channel. The CVSS 4.0 vector indicates NETWORK attack with high impact on confidentiality (Vulnerable: HIGH; Subsequent: NEGLIGIBLE) and no privileges required. The connected reco...
PT-2026-67134
Name of the Vulnerable Software and Affected Versions N-able N-central versions prior to 2026.1 Description An authentication bypass issue exists that allows an attacker to gain unauthorized access to administrative accounts by using an alternate path or channel. Recommendations Update N-able...
CVE-2026-51251
...
ROS-20260713-73-0028
The vulnerability of the crc32combine64 and crc32combinegen64 functions in the open-source data compression library zlib relates to the fact that the x2nmodp function may perform right shifts within a loop without a termination condition. Exploiting this vulnerability could allow an attacker to...
PYSEC-2026-1816 pyLoad CNL and captcha handlers allow Code Injection via unsanitized parameters
Summary pyLoad web interface contained insufficient input validation in both the Captcha script endpoint and the Click'N'Load CNL Blueprint. This flaw allowed untrusted user input to be processed unsafely, which could be exploited by an attacker to inject arbitrary content into the web UI or...
PYSEC-2026-2026 vLLM is vulnerable to timing attack at bearer auth
Summary The API key support in vLLM performed validation using a method that was vulnerable to a timing attack. This could potentially allow an attacker to discover a valid API key using an approach more efficient than brute force. Details...
MAL-2026-7077 Malicious code in @inheritdoc/n (npm)
--- -= Per source details. Do not edit below this line.=-...
CVE-2026-45442
Missing Authorization vulnerability in Brainstorm Force Presto Player allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Presto Player: from n/a through 4.1.3...