150434 matches found
Vulnerabilities Affecting SICK CorivaEngine
SICK CorivaEngine includes the third-party components Netty and Spring Cloud Gateway that are affected by multiple known vulnerabilities. Under certain conditions, these vulnerabilities could allow remote attackers to perform HTTP request smuggling, cause resource exhaustion, or manipulate...
CVE-2026-89264 MoguBlog through 6.2 Comment Author Spoofing via Request-Body Identity
MoguBlog through 6.2 fails to validate the comment author identity in the POST /web/comment/add endpoint, allowing authenticated users to post comments attributed to any other user. Attackers can supply arbitrary userUid values in the request body to impersonate other accounts including...
CVE-2026-89264
MoguBlog through 6.2 is vulnerable to comment author spoofing in the POST /web/comment/add endpoint. The server fails to validate that the userUid supplied in the request body matches the authenticated session, allowing any authenticated user to post comments attributed to any other account, incl...
CVE-2026-89262
MoguBlog through 6.2 contains an authorization bypass (IDOR) in its comment deletion endpoint. The root cause is that ownership checks are performed against request-body fields rather than the authenticated principal, allowing an unauthenticated attacker to delete arbitrary comments and their rep...
CVE-2026-89262 MoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership Check
MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields instead of the authenticated principal. Attackers can delete arbitrary comments and their replies by supplying comment UIDs and author UI...
CVE-2026-89262 MoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership Check
MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields instead of the authenticated principal. Attackers can delete arbitrary comments and their replies by supplying comment UIDs and author UI...
CVE-2026-89245 WWBN AVideo Cross-Site Request Forgery via playlistRemove.php
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in playlistRemove.php that allows attackers to delete playlists by skipping CSRF protection checks. Attackers can craft a malicious form that submits a POST request to...
CVE-2026-89245
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery (CSRF) vulnerability in playlistRemove.php . The root cause is that CSRF protection checks can be bypassed, allowing an attacker to craft a malicious form that submits a POST request to the e...
CVE-2026-89245 WWBN AVideo Cross-Site Request Forgery via playlistRemove.php
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in playlistRemove.php that allows attackers to delete playlists by skipping CSRF protection checks. Attackers can craft a malicious form that submits a POST request to...
CVE-2026-89245
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in playlistRemove.php that allows attackers to delete playlists by skipping CSRF protection checks. Attackers can craft a malicious form that submits a POST request to...
CVE-2026-87859
morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value...
CVE-2026-19486 SSRF in Gemini Enterprise Agent Platform App Builder
A Server-Side Request Forgery SSRF vulnerability in Google Cloud Gemini Enterprise Agent Platform App Builder versions prior to 2026-06-01 on Google Cloud Platform allows an unauthenticated attacker to leak the Compute Engine default service account access token. This vulnerability was patched on...
[SECURITY] [DSA 6493-1] libevent security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6493-1 [email protected] https://www.debian.org/security/ Aron Xu September 11, 2026 https://www.debian.org/security/faq -...
BIT-TOMCAT-2026-24880 Apache Tomcat: Request smuggling via invalid chunk extension
Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Tomcat via invalid chunk extension. This issue affects Apache Tomcat: from 11.0.0 through 11.0.18, from 10.1.0 through 10.1.52, from 9.0.0 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0...
EUVD-2026-75760
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an authenticated user to send a specially crafted request to write arbitrary files on the system...
PT-2026-89848
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in playlistRemove.php that allows attackers to delete playlists by skipping CSRF protection checks. Attackers can craft a malicious form that submits a POST request to...
ROS-20260911-73-0165
The vulnerability of the Workers component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the request. Exploiting this vulnerability allows an attacker to manipulate data integrity through a specially crafted HTML page...
ROS-20260911-73-0074
The vulnerability of the Font component in Google Chrome and Microsoft Edge relates to errors in HTTP request processing. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...
CVE-2026-79393
A heap-based buffer overflow vulnerability in the WS-Addressing Action transformation function in the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote unauthenticated attackers to cause a denial of service or potentially execute arbitrary cod...