52984 matches found
CVE-2026-110628
Versions 0.5.5 through 0.6.0 of Kan are vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) . This vulnerability exists in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255 . If the S3_ENDPOINT environment variable is unset, an attacker can provide ar...
Exploit for Improper Authorization in Microsoft
certighost – NXC module for CVE-2026-54121 NetExec NXC...
Important: Red Hat Security Advisory: kernel-rt security update
An update for kernel-rt is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
BIT-GITEA-2026-34966 Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass
Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply...
CLEANSTART-2026-HI23870 Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Web Services)
Security vulnerability affects the openjdk11 package. Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion component: Web Services...
@n8n/backend-module-insights (0.2.0), n8n (2.44.0) potentially affected by unknown CVE via @n8n/backend-services (1.4.0)
@n8n/backend-services NPM version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on @n8n/backend-services and may be impacted: - @n8n/backend-module-insights 0.2.0 - n8n 2.44.0 Source cves: unknown CVE Source advisory: MEND:WS-2026-0168...
@n8n/backend-module-insights (0.1.0), n8n (>=2.43.0, <=2.43.4) potentially affected by unknown CVE via @n8n/backend-services (>=1.3.0, <=1.3.2)
@n8n/backend-services NPM version =1.3.0, =2.43.0, =2.43.4 Source cves: unknown CVE Source advisory: MEND:WS-2026-0168...
Active Directory Certificate Services CA Chase Configuration Checker
The Certighost NetExec SMB module checks Active Directory Certificate Services configuration for the EDITFATTRIBUTESUBJECTALTNAME2 chase flag associated with CVE-2026-54121...
PT-2026-122303
Security vulnerability affects the openjdk11 package. Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion component: Web Services...
PT-2026-114070
Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3 ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch to read internal services,...
CVE-2026-55385: Server-Side Request Forgery (SSRF)
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf's PDFConfigurationRequest.php validates the owner-controlled gotenberghost setting only as a syntactically valid URL...
CVE-2026-110628: Server-Side Request Forgery (SSRF)
Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch to read internal services, localho...
Windows Deployment Services Code Execution
The vulnerability of Windows Deployment Services for Windows operating systems is related to synchronization errors when using a shared resource. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...
Active Directory Domain Services Code Execution
The vulnerability of Active Directory Domain Services for Windows operating systems is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities
Microsoft has released its monthly security update for October 2026, which includes 1415 vulnerabilities affecting a range of products, including 85 that Microsoft marked as "critical." Microsoft notes that 1 of the vulnerabilities disclosed this month have been exploited in the wild CVE-2026-969...
CVE-2026-78632 Insecure Default File Permissions in Okta RADIUS Agent Windows Installer
The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\ALL SERVICES and CREATOR OWNER security principals on the directories containing the agent configuration, AES encryption key, and logs. These permissions allow any local service account on the host to read the AES...
EUVD-2026-100484
The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\ALL SERVICES and CREATOR OWNER security principals on the directories containing the agent configuration, AES encryption key, and logs. These permissions allow any local service account on the host to read the AES...
CVE-2026-97830
Double free in Windows Internet Information Services allows an unauthorized attacker to deny service over a network...