Rocky Linux 8 [CIQ] Security Update: varnish / varnish-devel / varnish-docs / varnish-modules / etc (crlsa-2021_2988)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20212988 advisory. varnish: HTTP/2 request smuggling attack via a large Content-Length header for a POST request CVE-2021-36740 Tenable has extracted the preceding description block...

EUVD-2026-89468

The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request...

CVE-2026-41875 Cross-Site Request Forgery in admin panel of Quick.Cart

Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request that changes admin's login and password. This software does implement simple protection against this...

CVE-2026-8065

An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to upload arbitrary firmware through a crafted POST request. Successful exploitation could allow the attacker to modify device functionality or...

CVE-2026-93354

Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated attackers to register arbitrary OAuth clients and take over user accounts by exploiting the OAuth 2.0 Dynamic Client Registration endpoint, which is enabled by default and requires no...

CVE-2026-93354 Taskview Community Missing Authentication via OAuth Dynamic Client Registration

Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated attackers to register arbitrary OAuth clients and take over user accounts by exploiting the OAuth 2.0 Dynamic Client Registration endpoint, which is enabled by default and requires no...

CVE-2026-93354

Versions of Taskview Community before 1.56.0 are vulnerable to a missing authentication flaw in the OAuth 2.0 Dynamic Client Registration endpoint. Because this endpoint is enabled by default without authentication, unauthenticated attackers can submit a POST request to obtain a client_id and cli...

CVE-2026-93354: Initialization of a Resource with an Insecure Default

Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated attackers to register arbitrary OAuth clients and take over user accounts by exploiting the OAuth 2.0 Dynamic Client Registration endpoint, which is enabled by default and requires no...

PT-2026-98290

Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated attackers to register arbitrary OAuth clients and take over user accounts by exploiting the OAuth 2.0 Dynamic Client Registration endpoint, which is enabled by default and requires no...

EUVD-2026-85367

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination...

CVE-2026-96652 Plex Media Server SSRF

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination...

EUVD-2026-84624

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains an authorization bypass vulnerability in the billing module handler that allows unauthenticated remote attackers to modify any tenant's account balance by supplying crafted act and frombillingmodule parameters to the admin panel...

PT-2026-96922

Name of the Vulnerable Software and Affected Versions Softaculous Virtualizor versions prior to 3.2.9 Patch 9 Softaculous Virtualizor version 3.0.0 Description An authorization bypass exists in the billing module handler. Unauthenticated remote attackers can modify any tenant's account balance by...

CVE-2026-94411 jshERP 3.6 Privilege Escalation via updateOneValueByKeyIdAndType

jshERP 3.6 contains a privilege escalation vulnerability in the updateOneValueByKeyIdAndType endpoint that allows authenticated users to grant themselves arbitrary roles. Attackers can send a POST request with type=UserRole, their own user ID, and a role ID list to escalate from low-privilege...

PT-2026-95388

Name of the Vulnerable Software and Affected Versions NUUO Network Video Recorder version 2.0.0 Description An arbitrary file read issue exists in the 'up.php' endpoint. The application receives the url parameter via a POST request and uses the fopen function to open the specified URL in binary...

Tenda F451 Router httpd Heap Buffer Overflow DoS

The vulnerability of the fromwebExcptypemanFilter function /goform/webExcptypemanFilter in the httpd component of the Tenda F451 router microprogramming system is related to the issue of the operation going beyond the buffer in memory when processing the page parameter. Exploiting this...

Tenda A18 Router DoS

The vulnerability of the formfastsettingwifiset function /goform/fastsettingwifiset in the Tenda A18 router microprogramming software is related to buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to trigger a service failure by sending a specially crafted POST...

Tenda CX12L Wi-Fi Router DoS

The vulnerability of the fromAddressNat function /goform/addressNat in Tenda CX12L Wi-Fi routers is related to buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to trigger a service failure by sending a specially crafted POST request...

Tenda CX12L Wi-Fi router DoS

The vulnerability of the fromwebExcptypemanFilter function /goform/webExcptypemanFilter in the Tenda CX12L Wi-Fi router software is related to buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to trigger a service failure by sending a specially crafted POST reque...

Tenda CX12L Wi-Fi Router DoS

The vulnerability of the fromRouteStatic function /goform/RouteStatic in the Tenda CX12L Wi-Fi router software is related to buffer overflow in the stack. Exploiting this vulnerability could allow a malicious actor to trigger a service failure by sending a specially crafted POST request...