ENV-CVE-2021-3975

ENV-CVE-2021-3975 — libvirt vulnerability reproduction environment This repository is a snapshot of the reproducible vulnerability environment for CVE-2021-3975 libvirt qemuProcessHandleMonitorEOF use-after-free, CWE-416, exported from the corresponding container image yan5ui/cve-2021-3975:tier1...

CVE-2026-115195

A broken access control vulnerability exists in the Mautic Stats API /api/stats/table. The endpoint did not enforce permissions for several internal tables: an intended administrator-only restriction was never applied, and tables without an explicit permission mapping were readable by default. As...

CVE-2026-115195

A broken access control vulnerability exists in the Mautic Stats API /api/stats/table. The endpoint did not enforce permissions for several internal tables: an intended administrator-only restriction was never applied, and tables without an explicit permission mapping were readable by default. As...

CVE-2026-115195

A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}). The endpoint fails to enforce permissions for several internal tables because administrator-only restrictions were not applied and tables without explicit permission mappings are readable by default. Conseq...

CVE-2026-115195

A broken access control vulnerability exists in the Mautic Stats API /api/stats/table. The endpoint did not enforce permissions for several internal tables: an intended administrator-only restriction was never applied, and tables without an explicit permission mapping were readable by default. As...

CVE-2026-115195

A broken access control vulnerability exists in the Mautic Stats API /api/stats/table. The endpoint did not enforce permissions for several internal tables: an intended administrator-only restriction was never applied, and tables without an explicit permission mapping were readable by default. As...

CVE-2026-115195

A broken access control vulnerability exists in the Mautic Stats API /api/stats/table. The endpoint did not enforce permissions for several internal tables: an intended administrator-only restriction was never applied, and tables without an explicit permission mapping were readable by default. As...

EUVD-2026-109799

A broken access control vulnerability exists in the Mautic Stats API /api/stats/table. The endpoint did not enforce permissions for several internal tables: an intended administrator-only restriction was never applied, and tables without an explicit permission mapping were readable by default. As...

PT-2026-123315

A broken access control vulnerability exists in the Mautic Stats API /api/stats/table. The endpoint did not enforce permissions for several internal tables: an intended administrator-only restriction was never applied, and tables without an explicit permission mapping were readable by default. As...

Linux Distros Unpatched Vulnerability : CVE-2026-111804

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the...

CVE-2026-111804

Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to...

DEBIAN-CVE-2026-111804

Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to...

CVE-2026-111804

The Apache Traffic Server experimental wasm plugin is vulnerable to a use-after-free flaw located in its transaction-close handler . Additionally, the plugin forwards unvalidated guest-supplied metric IDs to the internal stats API. This issue impacts versions 10.0.0 through 10.1.4 and 10.2.0 . Af...

CVE-2026-111804 Apache Traffic Server: wasm plugin has a use-after-free and forwards unvalidated guest metric IDs

Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to...

EUVD-2026-107490

Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to...

CVE-2026-111804 Apache Traffic Server: wasm plugin has a use-after-free and forwards unvalidated guest metric IDs

Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to...

PT-2026-120767

Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to...

CVE-2026-79758

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.8.0 until 2.5.1, authenticated Termix users can access the server-stats API without per-host authorization. GET /status returns statuses for hosts the requester cannot access, GET...

PT-2026-97917

Name of the Vulnerable Software and Affected Versions Termix versions 1.8.0 through 2.5.0 Description Authenticated users can access the server-stats API without per-host authorization, failing to preserve tenant isolation. The affected routes in src/backend/ssh/server-stats.ts allow users to vie...

CVE-2026-79758: Improper Access Control

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.8.0 until 2.5.1, authenticated Termix users can access the server-stats API without per-host authorization. GET /status returns statuses for hosts the requester cannot access, GET...