50101 matches found
CVE-2026-44756
creationtimestamp| type| source ---|---|--- 2026-09-08 00:47:52+00:00| seen| https://bsky.app/profile/suriq.io/post/3muxsetw6fn2t 2026-09-08 00:54:27+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117232688633335518 2026-09-08 01:02:57+00:00| seen|...
EUVD-2026-72532
Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing authenticated accounts without content permissions to upload files. Attackers can upload polyglot files with attacker-chosen extensions to the public web root and execute code if t...
CVE-2026-86538
creationtimestamp| type| source ---|---|--- 2026-09-08 00:04:29+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3muxpxaxrxg2b 2026-09-18 17:00:28+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/58eb925f-807c-4a80-aebc-629f77cefdae...
CVE-2026-79577
An issue in the /cas/login component of sso-master v1.0.0 allows attackers to authenticate into the application without a password via sending a crafted POST request...
EUVD-2026-72850
An issue in the /cas/login component of sso-master v1.0.0 allows attackers to authenticate into the application without a password via sending a crafted POST request...
CVE-2026-79577
The sso-master v1.0.0 application contains a vulnerability in its /cas/login component. This flaw allows an attacker to bypass authentication and gain access to the application without a password by sending a crafted POST request . Detailed information regarding the specific root cause, exploitab...
CVE-2026-79577: Improper Access Control
An issue in the /cas/login component of sso-master v1.0.0 allows attackers to authenticate into the application without a password via sending a crafted POST request...
CVE-2026-86590: Server-Side Request Forgery (SSRF)
In Eclipse Che versions 7.79.0 through 7.121.0, the dashboard backend's POST /dashboard/api/data/resolver endpoint passes a caller-supplied URL directly to an outbound HTTP GET request with no host filtering. An authenticated user can exploit this server-side request forgery SSRF to read response...
CVE-2026-79577
An issue in the /cas/login component of sso-master v1.0.0 allows attackers to authenticate into the application without a password via sending a crafted POST request...
PT-2026-87101
Name of the Vulnerable Software and Affected Versions sso-master version 1.0.0 Description A flaw in the '/cas/login' endpoint allows attackers to authenticate into the application without providing a password by sending a specially crafted POST request. Recommendations At the moment, there is no...
CVE-2026-86734: Uncontrolled Resource Consumption
Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/acceptance endpoint, allowing authenticated users to submit unbounded input that reaches synchronous CommonMark rendering. Attackers can submit large note values to exhaust PHP worker CPU and cause...
CVE-2026-73317: Incorrect Authorization
XenForo before 2.3.13 contains a missing authorization vulnerability in the ACP cache-rebuild dispatcher that allows limited administrators with only the rebuildCache permission to perform unauthorized approval queue actions by supplying an arbitrary job class and actor user ID in the POST body...
PT-2026-87153
Name of the Vulnerable Software and Affected Versions MongoDB affected versions not specified Description Insufficient validation of shard key values during document insertion allows authenticated users to store documents with specially crafted, operator-shaped objects as shard key values in...
CVE-2026-86436
Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing authenticated accounts without content permissions to upload files. Attackers can upload polyglot files with attacker-chosen extensions to the public web root and execute code if t...
CVE-2026-86482
creationtimestamp| type| source ---|---|--- 2026-09-07 22:02:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3muxj5f3cc523...
CVE-2026-86436 Lara Dashboard before 1.3.2 Missing Authorization in Post-Builder Media Upload Endpoints
Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing authenticated accounts without content permissions to upload files. Attackers can upload polyglot files with attacker-chosen extensions to the public web root and execute code if t...
CVE-2026-86436 Lara Dashboard before 1.3.2 Missing Authorization in Post-Builder Media Upload Endpoints
Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing authenticated accounts without content permissions to upload files. Attackers can upload polyglot files with attacker-chosen extensions to the public web root and execute code if t...
CVE-2026-86299
creationtimestamp| type| source ---|---|--- 2026-09-07 19:11:53+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mux7m32cvv23 2026-09-08 12:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3muz26eb7rz2n...
PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution
Cybersecurity researchers have disclosed details of a complex Chromium-based post-exploitation toolkit called PEEP that masquerades as a bookmarks extension for the web browser. "Requiring prior administrative or code execution access, its installer injects the extension directly into Chrome/Edge...
CVE-2026-86478
creationtimestamp| type| source ---|---|--- 2026-09-07 18:07:36+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mux3z4eb5a25 2026-09-07 19:00:26+00:00| seen| https://infosec.exchange/users/offseq/statuses/117231296587754066 2026-09-07 19:00:28+00:00| seen|...