30241 matches found
Improper Privilege Management
Overview Affected versions of this package are vulnerable to Improper Privilege Management in the ActiveDirectoryIdentityProvider process. An attacker can gain elevated permissions in Kubernetes clusters by editing the distinguished name DN of group entries in the Active Directory server's databa...
CVE-2026-4298 DSGVO All in one for WP <= 4.9 - Missing Authorization to Authenticated (Subscriber+) Settings Reset
The DSGVO All in one for WP plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 4.9. This is due to the dsgvoresetpolicyservicefunc function lacking both capability checks and nonce verification while processing user-supplied parameters to reset plugin...
CVE-2026-51923
An Insecure Direct Object Reference IDOR vulnerability exists in docuForm GmbH Client v.11.11c allowing a remote attacker to execute arbitrary code via the user settings component, and modify or retrieve sensitive data associated with other users’ accounts...
CVE-2026-51923
An Insecure Direct Object Reference IDOR vulnerability exists in docuForm GmbH Client v.11.11c allowing a remote attacker to execute arbitrary code via the user settings component, and modify or retrieve sensitive data associated with other users’ accounts...
PT-2026-56885
Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.7.0 through 0.9.9 Description A flaw exists where the endpoint "/api/v1/channels//members" returns full UserModelResponse objects for channel members. This allows a standard channel participant to retrieve sensitive...
Linux Distros Unpatched Vulnerability : CVE-2026-13151
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitLab has remediated an issue in GitLab EE affecting all versions from 16.10 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain...
PT-2026-56930
Name of the Vulnerable Software and Affected Versions docuForm GmbH Client version 11.11c Description An Insecure Direct Object Reference IDOR issue exists in the user settings component. This allows a remote attacker to execute arbitrary code and modify or retrieve sensitive data belonging to...
CVE-2026-51923
An Insecure Direct Object Reference (IDOR) vulnerability exists in docuForm GmbH Client v.11.11c . A remote attacker can exploit the user settings component to achieve arbitrary code execution and perform unauthorized actions, such as modifying or retrieving sensitive data from other users' accou...
PT-2026-56794
Name of the Vulnerable Software and Affected Versions Xerte Online Tools affected versions not specified Description A flaw in the tools server settings allows for Remote Code Execution RCE. An attacker can modify the antivirus binary path to point to a PHP interpreter, enabling the upload and...
CVE-2026-55208: Improper Neutralization of Special Elements used in an SQL Command
Pimcore Studio Backend Bundle is the backend bundle for Pimcore Studio. Prior to 2025.4.6 and 2026.1.6, an authenticated user can extract the admin password hash and other database content through time-based blind SQL injection in the DateFilter column key parameter. The POST...
Linux Distros Unpatched Vulnerability : CVE-2026-58203
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pydantic-settings provides settings management using Pydantic. From 2.12.0 until 2.14.2, NestedSecretsSettingsSource reads secret values from files in a...
GitLab 16.10 < 18.11.7 / 19.0 < 19.0.4 / 19.1 < 19.1.2 (CVE-2026-13151)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 16.10 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticat...
CVE-2026-51923: Authorization Bypass Through User-Controlled Key
An Insecure Direct Object Reference IDOR vulnerability exists in docuForm GmbH Client v.11.11c allowing a remote attacker to execute arbitrary code via the user settings component, and modify or retrieve sensitive data associated with other users’ accounts...
ROS-20260709-73-0023
The vulnerability in the HTTP/2 implementation using the Go programming language arises from executing a loop with an unreachable exit condition when processing the value of SETTINGSMAXFRAMESIZE, which is equal to 0. Exploiting this vulnerability could allow a remote attacker to cause a service...
CVE-2026-59723
Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. Prior to 3.0.30, the Cline Hub dashboard server launched by the cline dashboard command accepts WebSocket connections on the /browser endpoint without validating the Origin header, and when ROOMSECRET is unset for loc...
CVE-2026-59723
Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. Prior to 3.0.30, the Cline Hub dashboard server launched by the cline dashboard command accepts WebSocket connections on the /browser endpoint without validating the Origin header, and when ROOMSECRET is unset for loc...
CVE-2026-59723 Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)
Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. Prior to 3.0.30, the Cline Hub dashboard server launched by the cline dashboard command accepts WebSocket connections on the /browser endpoint without validating the Origin header, and when ROOMSECRET is unset for loc...
CVE-2026-59723 Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)
Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. Prior to 3.0.30, the Cline Hub dashboard server launched by the cline dashboard command accepts WebSocket connections on the /browser endpoint without validating the Origin header, and when ROOMSECRET is unset for loc...
Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor
A flaw was found in Apache Tomcat. This Padding Oracle vulnerability, present in the EncryptInterceptor with its default configuration, could allow a remote attacker to decrypt sensitive information. By exploiting weaknesses in the encryption padding, an attacker may be able to gain unauthorized...