4304 matches found
wappalyzer-next v2.0.2
Wappalyzer Next This project is a command line tool and python library that uses the Wappalyzer browser extension and its fingerprints to detect technologies. Other projects that emerged after the discontinuation of the official open-source project are using outdated fingerprints and lack accurac...
PT-2026-80252
Summary The production media handler shipped by next-tinacms-s3 createMediaHandler in packages/next-tinacms-s3/src/handlers.ts accepts an attacker-chosen ?key= query parameter and returns an AWS-signed PutObject URL whose Key is that value, with no check that the key falls under the operator's...
CVE-2026-59992: Authorization Bypass Through User-Controlled Key
Tina is a headless content management system. Prior to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-tinacms-cloudinary 26.0.4, the first-party production media adapters pass attacker-controlled object keys to storage SDK upload and delete operations without...
CVE-2026-70684
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Agent Next Gen. Supported versions that are affected are 13.5 and 24.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...
CVE-2026-61300
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Agent Next Gen. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle...
EUVD-2026-61639
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Agent Next Gen. Supported versions that are affected are 13.5 and 24.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...
EUVD-2026-61361
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Agent Next Gen. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle...
CVE-2026-75833
The Grav API plugin (bundled with Grav 2.0's admin-next/API stack) before version 1.0.14 has an open redirect in SsoController::sanitizeReturnTo(): a backslash-prefix like /\evil.com bypasses the // guard and is normalized by browsers to //evil.com, enabling post-OAuth-login phishing. Exploitatio...
PT-2026-77683
Name of the Vulnerable Software and Affected Versions Oracle Enterprise Manager Base Platform Agent Next Gen version 13.5 Oracle Enterprise Manager Base Platform Agent Next Gen version 24.1 Description An issue in the Agent Next Gen component allows an unauthenticated attacker with network access...
PT-2026-77517
Name of the Vulnerable Software and Affected Versions Oracle Enterprise Manager Base Platform version 13.5 Oracle Enterprise Manager Base Platform version 24.1 Description A flaw in the Agent Next Gen component allows a low privileged attacker with access to the infrastructure where the platform...
CVE-2026-70684: Improper Access Control
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Agent Next Gen. Supported versions that are affected are 13.5 and 24.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...
CVE-2026-61300: Improper Access Control
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Agent Next Gen. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle...
CVE-2026-75108
Next Terminal fails to enforce per-asset authorization checks on the portal ping and wake-on-LAN endpoints, allowing any authenticated user to probe and wake assets they are not granted access to. Attackers can call these endpoints with arbitrary asset identifiers to retrieve asset information...
CVE-2026-75108 Next Terminal Missing Per-Asset Authorization on Portal Endpoints
Next Terminal fails to enforce per-asset authorization checks on the portal ping and wake-on-LAN endpoints, allowing any authenticated user to probe and wake assets they are not granted access to. Attackers can call these endpoints with arbitrary asset identifiers to retrieve asset information...
CVE-2026-75108
Next Terminal is vulnerable due to missing per-asset authorization checks on its portal ping and wake-on-LAN endpoints . Any authenticated user (PR:L) can supply arbitrary asset IDs to retrieve unauthorized asset metadata (display names, reachability, network addresses) or trigger wake-on-LAN pac...
EUVD-2026-60387
Next Terminal fails to enforce per-asset authorization checks on the portal ping and wake-on-LAN endpoints, allowing any authenticated user to probe and wake assets they are not granted access to. Attackers can call these endpoints with arbitrary asset identifiers to retrieve asset information...
CVE-2026-75108 Next Terminal Missing Per-Asset Authorization on Portal Endpoints
Next Terminal fails to enforce per-asset authorization checks on the portal ping and wake-on-LAN endpoints, allowing any authenticated user to probe and wake assets they are not granted access to. Attackers can call these endpoints with arbitrary asset identifiers to retrieve asset information...
ROOT-APP-NPM-CVE-2026-27979 CVE-2026-27979 in next - Patched by Root
Root has patched CVE-2026-27979 in the next package for Root:npm. Multiple fixed versions available...