14951 matches found
The vulnerability of the UniFi OS Server network management center arises from incorrect restrictions on the path to the directory, allowing unauthorized access by intruders to protected information.
The vulnerability of the UniFi OS Server network management center is related to an incorrect limitation on the path name to the catalog. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...
The vulnerability of the handleBondStateChanged method in the AdapterService.java class of Android operating systems allows a hacker to disclose protected information.
The vulnerability of the handleBondStateChanged method in the AdapterService.java class of Android operating systems is related to deficiencies in access control. Exploiting this vulnerability could allow attackers to disclose sensitive information that is protected by security measures...
Vulnerability of the “Yandex SpeechKit” module of the Content Management System (CMS) 1C-Bitrix: Website management related to the lack of authentication for critical functions, allowing attackers to compromise the confidentiality, integrity, and accessibility of protected information
Vulnerability of the “Yandex SpeechKit” module in the Content Management System CMS of 1C-Bitrix: Website management is associated with the absence of authentication for critical functions. Exploiting this vulnerability may allow a malicious actor to compromise the confidentiality, integrity, and...
PT-2026-48684
Name of the Vulnerable Software and Affected Versions Traefik versions prior to 2.11.48 Traefik versions prior to 3.6.19 Traefik versions prior to 3.7.3 Description An unauthenticated attacker can bypass route-level authentication and authorization in Traefik when PathPrefix-based public routes a...
The vulnerability in the KeyguardViewMediator.java class of Android operating systems allows a hacker to disclose protected information.
The vulnerability in the KeyguardViewMediator.java class of Android operating systems is related to incorrect code generation management. Exploiting this vulnerability can allow attackers to disclose sensitive information that is protected by the system’s security measures...
The vulnerability of the PHPShop content management system, related to insufficient validation of input data, allows attackers to gain unauthorized access to protected information.
The vulnerability of the PHPShop content management system is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...
PT-2026-46236
Name of the Vulnerable Software and Affected Versions MISP affected versions not specified Description A logic error in the CRUD component delete handler allows validation failures to be bypassed when using the HTTP DELETE method. This occurs because missing parentheses in the delete condition...
samba: vfs_worm does not block directory modification
A flaw was found in Samba’s vfsworm module. The module is intended to provide write-once, read-many WORM protections by preventing modification of files after a configurable grace period. Due to insufficient validation during rename operations, an authenticated user with write access to a share...
CVE-2026-36612
Mercusys AC12G EU V1 with firmware AC12GEUV1200909 enables WPS 2.0 by default with a weak lockout policy 60-second lockout after 10 attempts...
samba: vfs_worm does not block directory modification
A flaw was found in Samba’s vfsworm module. The module is intended to provide write-once, read-many WORM protections by preventing modification of files after a configurable grace period. Due to insufficient validation during rename operations, an authenticated user with write access to a share...
The vulnerability of the Django web development framework, related to deficiencies in the authentication process, allows attackers to gain unauthorized access to protected information.
The vulnerability of the Django web development framework is related to shortcomings in its authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...
The vulnerability of the decode_utf8 function in the base/gp_utf8.c software component, which is used for processing, transforming, and generating Ghostscript documents, allows a malicious actor to gain unauthorized access to protected information.
The vulnerability of the decodeutf8 function in the base/gputf8.c software component for processing and generating Ghostscript documents is related to an incorrect restriction on the path to the restricted directory. Exploiting this vulnerability could allow an attacker to gain unauthorized acces...
The vulnerability of Azure cloud services for managing geospatial data by Microsoft Planetary Computer Pro, related to deserialization mechanism flaws, allows attackers to disclose protected information.
The vulnerability of Azure cloud services for managing geospatial data with the Microsoft Planetary Computer Pro is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow a malicious actor to disclose protected information...
The vulnerability of the extractall() function in the Poetry dependency manager for the Python programming language allows a hacker to gain unauthorized access to protected information.
The vulnerability of the extractall function in the Poetry dependency manager for the Python programming language is related to an incorrect limitation on the path name of the restricted access directory. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to...
EUVD-2026-34151
Mercusys AC12G EU V1 with firmware AC12GEUV1200909 enables WPS 2.0 by default with a weak lockout policy 60-second lockout after 10 attempts...
The vulnerability of Microsoft 365 Copilot’s intelligent virtual assistant, related to the lack of measures for cleaning incoming data, allows a perpetrator to disclose protected information.
The vulnerability of Microsoft 365 Copilot’s intelligent virtual assistant is related to the lack of measures for cleaning incoming data. Exploiting this vulnerability could allow a malicious actor to disclose protected information remotely...
The vulnerability of the Microsoft Authenticator multi-factor authentication application, related to the disclosure of information, allows a perpetrator to gain unauthorized access to the protected information.
The vulnerability of the Microsoft Authenticator multi-factor authentication application is related to the disclosure of information. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...
The vulnerability of the modular interface of the Ruby-based Rack web server allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the Ruby-based Rack web server’s modular interface is related to partial comparison. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...
The vulnerability of the GenericInlineModelAdmin class in the Django web development framework allows a attacker to gain unauthorized access to protected information.
The vulnerability of the GenericInlineModelAdmin class in the Django web development framework is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...