149480 matches found
CVE-2026-73718: Cross-Site Request Forgery (CSRF)
A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access sensitive information if the attacker can convince an authenticated user of the interface to interact with a specially crafted URL. Successful...
Wazuh mask_sensitive_config() Unauthorized Access
The vulnerability of the masksensitiveconfig function on the security monitoring and threat detection platform provided by Wazuh is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access t...
PT-2026-84389
Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user can submit a specially crafted request that causes excessive resource consumption, which may render Kibana unavailable...
PT-2026-84265
Name of the Vulnerable Software and Affected Versions OTP versions 22.2 through 27.3.4.16 OTP versions 28.0 through 28.5.0.5 OTP versions 29.0 through 29.0.5 inets versions 7.1.2 through 9.3.2.6 inets versions 9.4 through 9.6.2.2 inets versions 9.7 through 9.7.1 Description Gracefulness code...
PT-2026-84257
Name of the Vulnerable Software and Affected Versions OTP versions 17.0 through 27.3.4.16 OTP versions 28.0 through 28.5.0.5 OTP versions 29.0 through 29.0.5 inets versions 5.10 through 9.3.2.6 inets versions 9.4 through 9.6.2.2 inets versions 9.7 through 9.7.1 Description httpd does not implemen...
PT-2026-84288
Cross-Site request forgery CSRF vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Cross Site Request Forgery. This issue affects Talassoft Industrial Management Software: from V.4 before V.16...
PT-2026-84518
Name of the Vulnerable Software and Affected Versions SonicWall SMA1000 Appliances affected versions not specified Description A pre-authentication Server-Side Request Forgery SSRF issue exists in the Work Place interface. This occurs due to an unintended alternate access path, allowing a remote...
TencentOS Server 4: keylime-agent-rust (TSSA-2026:0891)
The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0891 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...
TencentOS Server 4: libevent (TSSA-2026:0884)
The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0884 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...
openSUSE 16 Security Update : python-h2 (openSUSE-SU-2026:21693-1)
The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21693-1 advisory. This update for python-h2 fixes the following issue: - CVE-2026-71554: duplicate Host headers are accepted and forwarded to consuming applications, whic...
openSUSE 16 Security Update : python-aiohttp (openSUSE-SU-2026:21687-1)
The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21687-1 advisory. - CVE-2026-59881: excessive resource consumption due to WebSocket client accepting compressed frames without negotiated permessage-deflate...
Alibaba Cloud Linux 3 : 0271: nghttp2 (ALINUX3-SA-2026:0271)
The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0271 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-58055: nghttp2's nghttpx proxy through...
EUVD-2026-69410
llama.cpp through commit 97f06e9, when started with the --reranking flag, allows remote attackers to cause a denial of service std::badalloc and HTTP 500 via a negative topn value in a POST request to /rerank...
CVE-2026-51742: Improper Access Control
Incorrect access control in the discoverWan function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger WAN discovery logic via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
CVE-2026-51742
Incorrect access control in the discoverWan function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger WAN discovery logic via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
Malicious code in aether-foundation-request-tectonophysics (npm)
Source: amazon-inspector ffc9fd0a034150e047fd366ef04b684968fb67604112d8700999a30a191a84c5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in aether-link-request-promise (npm)
Source: amazon-inspector 6cd2a6fbdd0fd2a3975dbf408d242fa7675a68209e8547ca050aaf6e2ae6ac19 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in acamar-cosmos-start-request (npm)
Source: amazon-inspector 3efa5ae8bc81623cf737a4266be3ae0e7ad05a0df1ec0880493ee4f35ccb7ae1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in abstract-http-request (npm)
Source: amazon-inspector 84130e04f5582700fd6841f67e465fb571518a710f3257fae0990653bf08aa92 The package abstract-http-request was found to contain malicious code. --- Credit: OpenSSF source...