50417 matches found
CVE-2026-79423: Improper Neutralization of Special Elements used in an OS Command
An authenticated remote code execution RCE vulnerability in the adminconfig.php component of seacms v13.6 allows attackers to execute arbitrary code via a crafted POST request...
EUVD-2026-71768
An authenticated remote code execution RCE vulnerability in the adminconfig.php component of seacms v13.6 allows attackers to execute arbitrary code via a crafted POST request...
PT-2026-85699
CVE-2026-75170: Unauthenticated XSS in HubCore 14.1.1 via /loginController/doLogin language param. CVSS N/A, no patch yet. Attackers can inject arbitrary JS. Audit exposure and restrict access now. Details: https://t.co/2JPeD1RjLr CVE infosec XSS valtersit snippet infosec SysAdmin cybersecurity...
PT-2026-86257
An authenticated remote code execution RCE vulnerability in the admin config.php component of seacms v13.6 allows attackers to execute arbitrary code via a crafted POST request...
CVE-2026-79423
An authenticated remote code execution RCE vulnerability in the adminconfig.php component of seacms v13.6 allows attackers to execute arbitrary code via a crafted POST request...
CVE-2026-79423
A remote code execution (RCE) vulnerability exists in the admin_config.php component of seacms v13.6 . The flaw allows an authenticated attacker to execute arbitrary code by sending a crafted POST request . This vulnerability is characterized as an Improper Neutralization of Special Elements used...
CVE-2026-86090: Missing Authorization
ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts...
CVE-2026-86091: Missing Authorization
ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traff...
CVE-2026-85668: External Control of File Name or Path
Xinference affected commit 4a94832, v3.x contains an unauthenticated arbitrary-path file read vulnerability in the POST /v1/models/llm/auto-register endpoint, which accepts a caller-supplied modelpath parameter without authentication or path confinement. The endpoint reads and parses config.json,...
CVE-2026-79426
The CRMEB v6.0.0 platform contains an arbitrary file deletion vulnerability within the /adminapi/file/video_data_save component. This flaw allows authenticated attackers to delete arbitrary files on the system by sending a crafted POST request . Exploitation details or specific proof-of-concept l...
CVE-2026-85666: Server-Side Request Forgery (SSRF)
OGX formerly Llama Stack, affected at commit fbe8e0f contains an unauthenticated server-side request forgery vulnerability in the OpenAI-compatible POST /v1/responses endpoint. MCP tool definitions accept a serverurl parameter along with headers and authorization values that is fetched server-sid...
CVE-2026-85691: Server-Side Request Forgery (SSRF)
MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-side. Attackers can supply internal service URLs or metadata endpoints without authentication to read their responses directly from the JSON...
CVE-2026-85650: Server-Side Request Forgery (SSRF)
Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadat...
CVE-2026-85434
creationtimestamp| type| source ---|---|--- 2026-09-03 23:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3munmpvwqbt2w 2026-09-04 00:09:12+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3munodzancc2b...
CVE-2026-85430
creationtimestamp| type| source ---|---|--- 2026-09-03 23:30:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3munm62oo6t2o...
CVE-2026-85426
creationtimestamp| type| source ---|---|--- 2026-09-03 23:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3munlm6b7vw2l 2026-09-04 00:08:33+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3munocujoyo2t...
CVE-2026-85425
creationtimestamp| type| source ---|---|--- 2026-09-03 23:10:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3munl2dit722y 2026-09-04 00:08:24+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3munocmhb522b...
CVE-2026-85424
creationtimestamp| type| source ---|---|--- 2026-09-03 23:10:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3munl2bwa3a2w 2026-09-04 00:08:15+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3munocdsfxt2w...
CVE-2026-85061
creationtimestamp| type| source ---|---|--- 2026-09-03 21:00:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mundrvolze2g 2026-09-03 22:08:51+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3munhm3g2gz2g 2026-09-04 07:27:07+00:00| seen|...