2384 matches found
CVE-2026-19113
A flaw was found in Consul. A remote, unauthenticated attacker could exploit several agent HTTP API endpoints by sending a request with an unbounded body. This could cause the agent to consume substantial memory, leading to a denial of service DoS condition...
Improper Input Validation
Apache ActiveMQ is vulnerable to an Improper Input Validation vulnerability. The vulnerability is due to improper validation of negative content-length values in STOMP requests, which allows a remote unauthenticated attacker with access to an exposed STOMP connector to send malicious body data an...
CVE-2026-70461
rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against a read-only rsyn...
CVE-2026-73508
Netty CVE-2026-73508 affects the DNS record decoding path. Prior to Netty 4.1.136.Final and 4.2.16.Final, the code paths io.netty.handler.codec.dns.AbstractDnsRecord, io.netty.handler.codec.dns.DefaultDnsRecordDecoder.decodeRecord(), and io.netty.handler.codec.dns.DnsCodecUtil.decompressDomainNam...
TerraMaster TOS < 4.2.06 - User Enumeration
User Enumeration vulnerability in TerraMaster TOS = 4.2.06 allows remote unauthenticated attackers to identify valid users within the system via the username parameter to wizard/initialise.php. id: CVE-2020-28185 info: name: TerraMaster TOS 4.2.06 - User Enumeration author: pussycat0x severity:...
PT-2026-71661
rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against a read-only rsyn...
CVE-2026-18847
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to harvest credentials due to spoofing of Navigator for i...
EUVD-2026-57355
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to harvest credentials due to spoofing of Navigator for i...
CVE-2026-18847
CVE-2026-18847 affects IBM i 7.3–7.6 (Navigator for i) and could allow a remote unauthenticated attacker to harvest credentials due to spoofing of Navigator for i. Root cause: origin validation failure (CWE-346). Impact: credential harvest with high CVSS 3.1 base score 8.8 (Network, High confiden...
CVE-2026-18847
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to harvest credentials due to spoofing of Navigator for i...
CVE-2026-26035
An Improper Authentication vulnerability CWE-287 vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11, FortiWeb 7.2.0 through 7.2.12, FortiWeb 7.0.0 through 7.0.12 may allow a remote unauthenticated attacker to login into the Fortiweb...
CVE-2026-26035
Fortinet FortiWeb is affected by CVE-2026-26035 (Improper Authentication - CWE-287). Versions impacted: FortiWeb 8.0.0–8.0.2, 7.6.0–7.6.6, 7.4.0–7.4.11, 7.2.0–7.2.12, 7.0.0–7.0.12. A remote unauthenticated attacker could log into the FortiWeb GUI/CLI using a random username and password. The CVSS...
PT-2026-71059
An Improper Authentication vulnerability CWE-287 vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11, FortiWeb 7.2.0 through 7.2.12, FortiWeb 7.0.0 through 7.0.12 may allow a remote unauthenticated attacker to login into the Fortiweb...
CVE-2026-73241
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP server-side RDSTLS in libfreerdp/core/rdstls.c accepts an attacker-supplied RDSTLSTYPECAPABILITIES PDU while rdstlsserverauthenticate is waiting for RDSTLSTYPEAUTHREQ, leaving resultCode at RDSTLSRESULTSUCCE...
CVE-2026-73241
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP server-side RDSTLS in libfreerdp/core/rdstls.c accepts an attacker-supplied RDSTLSTYPECAPABILITIES PDU while rdstlsserverauthenticate is waiting for RDSTLSTYPEAUTHREQ, leaving resultCode at RDSTLSRESULTSUCCE...
EUVD-2026-56158
Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MITM position to leak credentials for external SQL connections...
CVE-2026-18125
An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker to crash an agent service...
EUVD-2026-56154
An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker to crash an agent service...
CVE-2026-18125
CVE-2026-18125 reports an out-of-bounds read in the Ivanti Endpoint Manager Agent prior to 2024 SU7, allowing a remote unauthenticated attacker to crash the agent service (CVSS v3.1 base score 7.5, HIGH). Affected software: Ivanti Endpoint Manager Agent (pre-2024 SU7). The document does not provi...