74 matches found
CVE-2026-18111 Concrete CMS below 9.5.4 allows privilege escalation because adding users and assigning groups do not require additional identity verification
Concrete CMS 9 before 9.5.3 was vulnerable to stored cross-site scripting XSS in the Feature, Feature Link, Hero Image, and Image blocks and before Concrete 8.5.21 in the feature and Image blocks because the external link URL was insufficiently validated by the link filter and was rendered withou...
EUVD-2026-78213
A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. User interaction an AclAgent restart by an...
CVE-2026-75944
A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. User interaction an AclAgent restart by an...
CVE-2026-75944
CVE-2026-75944 is a race condition in Arista EOS 802.1X supplicant re-authentication that may leave a stale ACL entry in the system. If the AclAgent subsequently restarts, the stale entry can be applied to new supplicants, causing incorrect access control enforcement. The vulnerability requires 8...
CVE-2026-75944 A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. User
A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. User interaction an AclAgent restart by an...
CVE-2026-86497
In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials...
CVE-2026-86497
In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials...
CVE-2026-86497
In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials...
EUVD-2026-72513
In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials...
CVE-2026-86497
JetBrains YouTrack versions before 2026.2.18769 contained a vulnerability in the mailbox configuration flow. Changing a mailbox host did not require re-authentication, allowing a project administrator to exfiltrate stored mailbox credentials . The CVSS 3.1 score is 6.8 (MEDIUM) with a network att...
PT-2026-39717
Name of the Vulnerable Software and Affected Versions Bitwarden Server versions prior to 2026.4.1 Description An issue exists where master-password re-authentication is not required when retrieving or rotating an organization's SCIM API key. This allows an authenticated user with SCIM management...
bitwarden 安全漏洞
Bitwarden is an open-source password management backend service developed by Bitwarden. Versions of Bitwarden prior to 2026.4.1 contained security vulnerabilities. These vulnerabilities stemmed from the lack of a master password re-authentication requirement when retrieving or rotating organizati...
CVE-2026-6848
A flaw was found in Red Hat Quay. When Red Hat Quay requests password re-verification for sensitive operations, such as token generation or robot account creation, the re-authentication prompt can be bypassed. This allows a user with a timed-out session, or an attacker with access to an idle...
CVE-2026-6848 Quay: red hat quay: authentication bypass allows privileged actions without valid credentials
A flaw was found in Red Hat Quay. When Red Hat Quay requests password re-verification for sensitive operations, such as token generation or robot account creation, the re-authentication prompt can be bypassed. This allows a user with a timed-out session, or an attacker with access to an idle...
CVE-2019-12468
An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.27.0 through 1.32.1. Directly POSTing to Special:ChangeEmail would allow for bypassing re-authentication, allowing for potential account takeover...
Revive Adserver: Authorization bypass allows changing email address of other users
The Revive Adserver 6.0.0 was found to have an authorization bypass vulnerability that allowed changing the email address of other users without requiring the account password. The vulnerability was present in the admin panel endpoint /admin/agency-user.php, which accepted a POST request that...
EUVD-2020-29671
Malware in sbrugna...
EUVD-2002-0484
Malware in sbrugna...