CVE-2026-118581

A flaw was found in the MongoDB Java Driver. The BSON Binary JSON encoding component fails to verify that an externally supplied raw document's declared length matches its actual byte range before copying it into an outgoing database command. A remote attacker can exploit this flaw by submitting...

PT-2026-132085

Name of the Vulnerable Software and Affected Versions StylemixThemes Motors versions prior to 1.4.127 Description An improper neutralization of special elements used in an SQL command allows for Blind SQL Injection within the vehicle listings extension. This issue enables an attacker to execute...

CVE-2026-19396

A predictable seed in the pseudo-random number generator PRNG in the IFTTT pairing token generation of the ASUS RT-BE57 router allows an unauthenticated nearby user to derive the pairing token and read or modify router settings via observed values from an administrator-initiated IFTTT pairing...

CVE-2026-19396

The ASUS RT-BE57 router is vulnerable to an issue where a predictable seed in the pseudo-random number generator (PRNG) is used during IFTTT pairing token generation . This flaw allows an unauthenticated nearby user to derive the pairing token by observing values during an administrator-initiated...

Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass

SummaryThe Mnemosyne sync server's authentication check decoded JWT bearer tokens but never verified their HMAC-SHA256 signatures. Any well-formed token was accepted, allowing an unauthenticated attacker to impersonate any user and read or modify their sync data.Severity: CriticalCVSS 3.1:...

CVE-2026-100540

Versions of OpenClaw Feishu prior to 2026.8.1 are vulnerable to an authentication bypass because the system fails to verify if a configured default account is disabled before using it for model tool operations. In multi-account configurations, an attacker can exploit a disabled default account th...

PT-2026-99177

Name of the Vulnerable Software and Affected Versions OpenClaw Feishu versions prior to 2026.8.1 Description The software fails to validate if a configured default account is disabled before selecting it for model tool operations. In multi-account configurations, this allows attackers to use a...

Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack via the recovery token comparison in handleLogicalRecovery in http/logical.go. An attacker can extract the single recovery token and use it to perform privileged recovery-mode API operations by repeatedly sending candidate...

CVE-2026-77517: Authorization Bypass Through User-Controlled Key

MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.10.2-lts, document and paragraph operate routes authorize only knowledgeid in the request path, then query the target Document by documentid or Paragraph by paragraphid without confirming that the object belongs to...

CVE-2026-52723

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration performs VAU server certificate validation in app/vau/VAUProtokoll.py without anchoring the signedvauserverpubkeys and...

CVE-2026-9341

The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.8.0 via the 'savelessonnote', 'getlessonnote', and 'completelessonvideo' AJAX handlers due to missing validation on...

CVE-2026-41075: Improper Neutralization of Special Elements used in an SQL Command

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 through 5.0.9 and 6.0.0 through 6.0.2 contain an SQL injection vulnerability. An authenticated user can craft input that is incorporated into database queries without proper validation, potentially allowing th...

CVE-2026-42889

Relay adds real-time collaboration to Obsidian. Relay Server versions 0.9.0 through 0.9.6 contain an authentication bypass in the multi-document WebSocket endpoints. When authentication is configured, WebSocket connections without a token query parameter were incorrectly treated as having full...

CVE-2026-42889: Incorrect Authorization

Relay adds real-time collaboration to Obsidian. Relay Server versions 0.9.0 through 0.9.6 contain an authentication bypass in the multi-document WebSocket endpoints. When authentication is configured, WebSocket connections without a token query parameter were incorrectly treated as having full...

BIT-JRE-2026-21933

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17...

CVE-2026-25927: Authorization Bypass Through User-Controlled Key

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the DICOM viewer state API e.g. upload or state save/load accepts a document ID docid without verifying that the document belongs to the current user’s authorized patie...

VulnCheck KEV: CVE-2018-1217

Avamar Installation Manager in Dell EMC Avamar Server 7.3.1, 7.4.1, and 7.5.0, and Dell EMC Integrated Data Protection Appliance 2.0 and 2.1, is affected by a missing access control check vulnerability which could potentially allow a remote unauthenticated attacker to read or change the Local...

CVE-2024-21902: Incorrect Permission Assignment for Critical Resource

An incorrect permission assignment for critical resource vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to read or modify the resource via a network. We have already fixed the vulnerability in the...

CVE-2023-20185: Use of Insufficiently Random Values

A vulnerability in the Cisco ACI Multi-Site CloudSec encryption feature of Cisco Nexus 9000 Series Fabric Switches in ACI mode could allow an unauthenticated, remote attacker to read or modify intersite encrypted traffic. This vulnerability is due to an issue with the implementation of the cipher...

CVE-2017-1396: Undefined Security Weakness

IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. IBM X-Force ID: 127342...