Exploit for CVE-2026-77812

CVE-2026-77812 — DJI Cleartext BLE Transmission of Wi-Fi PSK a...

BASM (Broken Authentication & Session Management) org.apache.sshd:sshd-core Dependency in Crucible Server

This High severity BASM Broken Authentication & Session Management vulnerability was introduced in version 4.9.7 of Crucible Server. This BASM Broken Authentication & Session Management vulnerability, with a CVSS Score of 7.3 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N allow...

BASM (Broken Authentication & Session Management) org.apache.tomcat:tomcat-catalina Dependency in Jira Software Data Center

This High severity BASM Broken Authentication & Session Management vulnerability was introduced in versions 9.12.1, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Software Data Center. This BASM Broken Authentication & Session Management...

BASM (Broken Authentication & Session Management) org.apache.tomcat:tomcat-catalina Dependency in Jira Service Management Data Center

This High severity BASM Broken Authentication & Session Management vulnerability was introduced in versions 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Service Management Data Center. This BASM Broken Authentication & Session Management...

BASM (Broken Authentication & Session Management) org.apache.tomcat:tomcat-catalina Dependency in Bamboo Data Center

This High severity BASM Broken Authentication & Session Management vulnerability was introduced in versions 10.1.1, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This BASM Broken Authentication & Session Management vulnerability, with a CVSS Score of 8.1 and a CVSS Vector of...

BASM (Broken Authentication & Session Management) io.netty:netty-handler Dependency in Jira Service Management Data Center

This High severity BASM Broken Authentication & Session Management vulnerability was introduced in versions 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Service Management Data Center. This BASM Broken Authentication & Session Management...

BASM (Broken Authentication & Session Management) io.netty:netty-handler Dependency in Bamboo Data Center

This High severity BASM Broken Authentication & Session Management vulnerability was introduced in versions 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This BASM Broken Authentication & Session Management vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of...

BIT-ZOOKEEPER-2026-79993 Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode

The deleteContainer opcode 0x14/20 is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. This opcode is considered internal-only and the official clie...

CVE-2026-88824

The Master Blocks WordPress plugin versions before 1.5.0 (specifically 1.4.1-1.4.1.4 ) contains an unauthenticated Stored XSS vulnerability. The root cause is a lack of authorization on one of its REST routes , which allows unauthenticated users to update plugin settings. A specific value updated...

SUSE CVE-2026-89788

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix tree connection use-after-free in smb2treeconnect ksmbdtreeconnconnect publishes a new tree connection in sess-treeconns with a single reference and returns its pointer to smb2treeconnect. The handler continues to...

[slackware-security] stunnel

New stunnel packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/stunnel-5.82-i586-1slack15.0.txz: Upgraded. This update fixes security issues: Fixed truncation and out-of-bounds reads when inheriti...

CVE-2026-75878

IBM Sterling File Gateway could allow a remote attacker to bypass authentication and obtain a fully authenticated session due to improper authentication via an unvalidated SSO header...

Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client max-stale directives. An unauthenticated attacker can request the same URL with a large max-stale value to retrieve cached responses...

Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client max-stale directives. An unauthenticated attacker can request the same URL with a large max-stale value to retrieve cached responses...

CVE-2026-75878 IBM Sterling File Gateway is Vulnerable to Authentication Bypass

IBM Sterling File Gateway could allow a remote attacker to bypass authentication and obtain a fully authenticated session due to improper authentication via an unvalidated SSO header...

CVE-2026-75878 IBM Sterling File Gateway is Vulnerable to Authentication Bypass

IBM Sterling File Gateway could allow a remote attacker to bypass authentication and obtain a fully authenticated session due to improper authentication via an unvalidated SSO header...

CVE-2026-75878

IBM Sterling File Gateway versions 6.2.0.0 through 6.2.0.6_1, 6.2.1.0 through 6.2.1.2, and 6.2.2.0 through 6.2.2.1 allow a remote attacker to bypass authentication and obtain a fully authenticated session by sending an unvalidated SSO header (CWE-287: Improper Authentication). The vulnerability i...

EUVD-2026-83300

IBM Sterling File Gateway could allow a remote attacker to bypass authentication and obtain a fully authenticated session due to improper authentication via an unvalidated SSO header...

Withdrawn Advisory: http-cache-semantics max-stale handling can disclose cross-user cached responses

Withdrawn Advisory This advisory has been withdrawn because it's not a valid vulnerability. This link is maintained to preserve external references. Original Description http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale...

CVE-2026-92701

Cocos AI is a confidential computing system for AI. In Cocos AI 0.8.2 and earlier, VerifTeeAttestation in the Intel TDX aTLS verifier receives an expected current-session value but does not apply it to TdQuoteBodyPolicy.ReportData before validating TDX QuoteV4 evidence. The verifier can...