50104 matches found
EUVD-2026-72343
Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because protocol-relative URLs such as //attacker.example also begin with / but resolve to an external origin in browsers. The vulnerable homepage...
CVE-2026-86351
MISP (versions ≤2.5.45 ) is affected by an authenticated open redirect in the user-configurable homepage feature. The validation only checked whether the supplied value begins with /, which is insufficient because protocol-relative URLs such as //attacker.example also start with / but resolve to ...
CVE-2026-86332
creationtimestamp| type| source ---|---|--- 2026-09-07 09:40:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/hbqcusf43d73t...
CVE-2026-78410
creationtimestamp| type| source ---|---|--- 2026-09-07 02:01:20+00:00| seen| https://bsky.app/profile/slackers.it/post/3muvfz7thww2s...
CVE-2026-78409
creationtimestamp| type| source ---|---|--- 2026-09-07 02:01:20+00:00| seen| https://bsky.app/profile/slackers.it/post/3muvfz7thww2s...
CVE-2026-86235
creationtimestamp| type| source ---|---|--- 2026-09-07 01:47:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/hbem2pqty2e3x...
CVE-2026-86234
creationtimestamp| type| source ---|---|--- 2026-09-07 01:35:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/jkgjvni3vk4i6...
CVE-2026-86538: Improper Limitation of a Pathname to a Restricted Directory
knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates/preview endpoint that allows unauthenticated attackers to read arbitrary files. Attackers can supply directory traversal sequences in the templateFile parameter to bypass path restrictions and read...
CVE-2026-86539: Server-Side Request Forgery (SSRF)
knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplied destinations without validation. Attackers can enumerate internal hosts and cloud metadata endpoints by observing transport...
CVE-2026-86416: Missing Authorization
ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject and updateGroupTypeObject perform state-changing operations without write permission checks. Authenticated users with only read access to a group can craft POST...
CVE-2026-12757: Improper Control of Generation of Code
The The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.9.27. This is due to the software allowing users to execute an action that do...
PT-2026-86679
Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because protocol-relative URLs such as //attacker.example also begin with / but resolve to an external origin in browsers. The vulnerable homepage...
CVE-2026-86351: URL Redirection to Untrusted Site
Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because protocol-relative URLs such as //attacker.example also begin with / but resolve to an external origin in browsers. The vulnerable homepage...
CVE-2026-82758: Improper Authentication
Improper Authentication vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolvesecret/3 in AshAuthentication.Oauth2Server reached through resolvesecre...
CVE-2026-82754: Improper Protection of Alternate Path
Improper Protection of Alternate Path vulnerability in ash-project ashauthenticationoauth2server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix. oauth2serverprotocolroutes/1 in...
CVE-2026-86437: Incorrect Authorization
Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin administrators to upload and extract arbitrary zip archives over the live application source code. Attackers can upload a malicious archive...
CVE-2026-83534
creationtimestamp| type| source ---|---|--- 2026-09-06 17:53:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/hjru5723mgrpw...
CVE-2021-38817
creationtimestamp| type| source ---|---|--- 2026-09-06 15:00:03+00:00| published-proof-of-concept| Telegram/43D4qhGTDojIuKxnHISZ4eUxiWEszw-obZ3Am-s-rJ4mag 2026-09-07 01:00:11+00:00| published-proof-of-concept| Telegram/43D4qhGTDojIuKxnHISZ4eUxiWEszw-obZ3Am-s-rJ4mag...