17808 matches found
CVE-2026-86768 Snipe-IT before 8.7.0 Improper Input Validation via API Checkout
Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with checkout permissions to bind live inventory to trashed targets. Attackers can submit POST requests to hardware, component, or consumable checkout endpoints with soft-deleted use...
CVE-2026-86768
Snipe-IT before 8.7.0 is affected by an improper input validation flaw in its API checkout endpoints. The product fails to validate the soft-deleted state of referenced objects, allowing any authenticated user with checkout permissions to submit POST requests to hardware, component, or consumable...
CVE-2026-86768 Snipe-IT before 8.7.0 Improper Input Validation via API Checkout
Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with checkout permissions to bind live inventory to trashed targets. Attackers can submit POST requests to hardware, component, or consumable checkout endpoints with soft-deleted use...
CVE-2026-86203 PocketMine-MP before 5.39.2 Item Duplication via Despawn State
PocketMine-MP versions before 5.39.2 fail to validate entity despawn state when processing attack packets from clients. Attackers can exploit a race condition by attacking a disconnecting player to trigger multiple death handlers, causing inventory items and experience to drop multiple times for...
CVE-2026-86203 PocketMine-MP before 5.39.2 Item Duplication via Despawn State
PocketMine-MP versions before 5.39.2 fail to validate entity despawn state when processing attack packets from clients. Attackers can exploit a race condition by attacking a disconnecting player to trigger multiple death handlers, causing inventory items and experience to drop multiple times for...
CVE-2026-86203
PocketMine-MP versions before 5.39.2 contain an item duplication vulnerability caused by a failure to validate entity despawn state when processing attack packets from clients. A race condition allows an attacker to attack a disconnecting player, triggering multiple death handlers that cause inve...
CVE-2026-79965
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an External Control of Critical State Data vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized...
EUVD-2026-74896
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an External Control of Critical State Data vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized...
CVE-2026-79965
Dell Secure Connect Gateway 5.0 (both Appliance and Application editions) is affected by an External Control of Critical State Data vulnerability. An unauthenticated attacker with network access could exploit it to achieve unauthorized access , resulting in a low confidentiality impact (CVSS 3.1:...
SCTT-2026-33-0004-FortiCloud-SSO-Identity-Singularity
SCTT-2026-33-0004: FortiCloud SSO Identity Singularity This is the full implementation of the SCTT-0004 vector. 📡 Technical Analysis While Fortinet's January 27, 2026 mitigation for CVE-2026-24858 focuses on blocking specific accounts like [email protected], it fails to address the Temporal...
CVE-2022-40769---Profanity
DONATE: bc1qps62cyk9f9unmdkc9k3ccj9e2h8ywfhg2j53ec 用 ❤️ 为加密货币研究社区打造。 ============================================================ CVE-2023-39910 + CVE-2022-40769 - 密钥生成器转TXT 描述： 本工具根据影响加密货币钱包的两个关键漏洞生成私钥。它创建包含十六进制私钥（64字符 = 256位）的TXT文件，这些文件可以输入到AllChainScanner进行地址生成和余额检查。 🔴 从两大加密货币漏洞生成密钥！...
CVE-2026-87724
A flaw was found in Tor. A remote attacker could exploit this vulnerability by sending a specific congestion-control CC response extension without first sending a corresponding request. This misinterpretation of the CCRESPONSE extension leads to a corrupted congestion-control state, which can cau...
CVE-2026-13146
The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer's email address to change that customer's booking payment state and attach a...
WordPress WP Travel plugin < 12.0.2 - Unauthenticated Booking Payment State Tampering vulnerability
Unauthenticated Booking Payment State Tampering vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin WP Travel versions 12.0.2...
EUVD-2026-74699
The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer's email address to change that customer's booking payment state and attach a...
CVE-2026-13146
WP Travel is a WordPress plugin that facilitates travel booking management. Versions before 12.0.2 contain an Insecure Direct Object Reference (IDOR) flaw in the bank-deposit slip submission endpoint: the plugin does not properly verify that the requester owns the targeted booking. An unauthentic...
CVE-2026-13146 WP Travel < 12.0.2 - Unauthenticated Booking Payment State Tampering via IDOR
The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer's email address to change that customer's booking payment state and attach a...
CVE-2026-20127-Exploit-Extension
Executive Summary The CVE-2026-20127 Defensive Companion is a premier, enterprise-grade Browser Extension engineered for proactive threat intelligence and defensive analysis. This tool encapsulates authoritative technical research concerning the authentication bypass vulnerability in the Cisco...
EUVD-2026-74539
Tor before 0.4.9.12 interprets the CCRESPONSE extension even when CCREQUEST was not sent, which allows remote attackers to cause a denial of service crash because of corrupted congestion-control state. This is TROVE-2026-032...