CVE-2026-25774 EV Energy ev.energy Insufficiently Protected Credentials

Charging station authentication identifiers are publicly accessible via web-based mapping platforms...

CVE-2026-20733: Insufficiently Protected Credentials

Charging station authentication identifiers are publicly accessible via web-based mapping platforms...

MacOS Information Disclosure

The vulnerability of the MacOS operating system is related to the exposure of information. Exploiting this vulnerability can allow an intruder to gain unauthorized access to protected information...

Cisco Catalyst SD-WAN Manager Authentication Bypass

The vulnerability of the centralized network management system Cisco Catalyst SD-WAN Manager is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information by sending specially crafted...

cadence macb_main Heap Buffer Overflow DoS

The vulnerability of the gemgetethtoolstats function in the drivers/net/ethernet/cadence/macbmain.c file of the Linux kernel is related to writing beyond the valid memory range. Exploiting this vulnerability could allow an attacker to compromise the integrity, confidentiality, and accessibility o...

MacOS Inherited Permissions Unauthorized Access

The vulnerability of the MacOS operating system is related to errors with inherited permissions. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

iOS iPadOS Authentication Bypass

The vulnerability of iOS and iPadOS operating systems is related to improper authentication. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information...

iOS iPadOS Information Disclosure

The vulnerability of iOS and iPadOS operating systems is related to improper handling of exceptional states. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

MacOS Information Disclosure

The vulnerability of the MacOS operating system is related to the disclosure of information through registration files. Exploiting this vulnerability can allow an intruder to gain unauthorized access to the protected location information...

CVE-2026-28275

Initiative is a self-hosted project management platform. Versions of the application prior to 0.32.4 do not invalidate previously issued JWT access tokens after a user changes their password. As a result, older tokens remain valid until expiration and can still be used to access protected API...

CVE-2026-28275 Initiative Vulnerable to Improper Session Invalidation (JWT Remains Valid)

Initiative is a self-hosted project management platform. Versions of the application prior to 0.32.4 do not invalidate previously issued JWT access tokens after a user changes their password. As a result, older tokens remain valid until expiration and can still be used to access protected API...

CVE-2026-24908

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an SQL injection vulnerability in the Patient REST API endpoint allows authenticated users with API access to execute arbitrary SQL queries through the sort parameter...

CVE-2026-22207

OpenViking through version 0.1.18, prior to commit 0251c70, contains a broken access control vulnerability that allows unauthenticated attackers to gain ROOT privileges when the rootapikey configuration is omitted. Attackers can send requests to protected endpoints without authentication headers ...

DEBIAN-CVE-2026-22205

SPIP versions prior to 4.4.10 contain an authentication bypass vulnerability caused by PHP type juggling that allows unauthenticated attackers to access protected information. Attackers can exploit loose type comparisons in authentication logic to bypass login verification and retrieve sensitive...

CVE-2026-22205

SPIP versions prior to 4.4.10 contain an authentication bypass vulnerability caused by PHP type juggling that allows unauthenticated attackers to access protected information. Attackers can exploit loose type comparisons in authentication logic to bypass login verification and retrieve sensitive...

CVE-2026-22207

OpenViking through version 0.1.18, prior to commit 0251c70, contains a broken access control vulnerability that allows unauthenticated attackers to gain ROOT privileges when the rootapikey configuration is omitted. Attackers can send requests to protected endpoints without authentication headers ...

CVE-2026-22207 OpenViking Missing root_api_key Allows Anonymous ROOT Access

OpenViking through version 0.1.18, prior to commit 0251c70, contains a broken access control vulnerability that allows unauthenticated attackers to gain ROOT privileges when the rootapikey configuration is omitted. Attackers can send requests to protected endpoints without authentication headers ...

CVE-2026-22207

OpenViking up to version 0.1.18 (pre-commit 0251c70) contains a broken access control flaw that lets unauthenticated attackers gain ROOT privileges when root_api_key is omitted. Attackers can reach protected endpoints without authentication headers to perform administrative actions including acco...

CVE-2026-22207 OpenViking Missing root_api_key Allows Anonymous ROOT Access

OpenViking through version 0.1.18, prior to commit 0251c70, contains a broken access control vulnerability that allows unauthenticated attackers to gain ROOT privileges when the rootapikey configuration is omitted. Attackers can send requests to protected endpoints without authentication headers ...

CVE-2026-22205

SPIP versions prior to 4.4.10 contain an authentication bypass vulnerability caused by PHP type juggling that allows unauthenticated attackers to access protected information. Attackers can exploit loose type comparisons in authentication logic to bypass login verification and retrieve sensitive...