25249 matches found
CVE-2026-75792
IBM Sterling Secure Proxy versions 6.2.0.0 through 6.2.1.2 are affected by a client-side authorization bypass (CWE-285: Improper Authorization) that allows a remote authenticated attacker to view administrative user interface components . The vulnerability carries a CVSS 3.1 score of 4.3 (MEDIUM)...
CVE-2026-75792 IBM Sterling Secure Proxy is vulnerable to multiple issues
IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 could allow a remote authenticated attacker to view administrative user interface components due to client-side authorization bypass...
EUVD-2026-78140
IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 could allow a remote authenticated attacker to view administrative user interface components due to client-side authorization bypass...
CVE-2026-78415 IBM Sterling Secure Proxy is vulnerable to multiple issues
IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 could allow a remote authenticated attacker to perform UI spoofing and phishing attacks due to improper neutralization of user-supplied HTML markup...
EUVD-2026-78139
IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 could allow a remote authenticated attacker to perform UI spoofing and phishing attacks due to improper neutralization of user-supplied HTML markup...
CVE-2026-78415
IBM Sterling Secure Proxy versions 6.2.0.0 through 6.2.1.2 are affected by a vulnerability where improper neutralization of user-supplied HTML markup (CWE-79) allows a remote authenticated attacker to perform UI spoofing and phishing attacks . The attack requires low privileges and low complexity...
CVE-2026-78415 IBM Sterling Secure Proxy is vulnerable to multiple issues
IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 could allow a remote authenticated attacker to perform UI spoofing and phishing attacks due to improper neutralization of user-supplied HTML markup...
Security Bulletin: IBM Sterling Secure Proxy is vulnerable to multiple issues
Summary Multiple vulnerabilities CVE-2026-78415, CVE-2026-75792 affect IBM Sterling Secure Proxy and are addressed in the latest release and fixpack. Vulnerability Details CVEID:CVE-2026-78415 DESCRIPTION: IBM Sterling Secure Proxy could allow a remote authenticated attacker to perform UI spoofin...
CVE-2026-82433
Description getNimbusConf returned the complete daemon configuration without redaction after only a user-level authorization check. Where the cluster is configured with them, that response includes storm.zookeeper.auth.payload and the keystore and truststore passwords for the Thrift, Netty and...
CVE-2026-57124 PraisonAI UI MCP connect endpoint allows unauthenticated local command execution
PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and accept caller-controlled command and args values that PraisonAIUI passes to StdioMCPClient to start a local process. Because the UI commands...
CVE-2026-57124 PraisonAI UI MCP connect endpoint allows unauthenticated local command execution
PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and accept caller-controlled command and args values that PraisonAIUI passes to StdioMCPClient to start a local process. Because the UI commands...
CVE-2026-82433 Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI
Description getNimbusConf returned the complete daemon configuration without redaction after only a user-level authorization check. Where the cluster is configured with them, that response includes storm.zookeeper.auth.payload and the keystore and truststore passwords for the Thrift, Netty and...
CVE-2026-82433
Apache Storm's Nimbus and UI components are vulnerable to the disclosure of unredacted daemon configurations. The getNimbusConf function failed to redact sensitive information, such as the storm.zookeeper.auth.payload and keystore/truststore passwords for Thrift, Netty, and ZooKeeper TLS configur...
CVE-2026-84179
Apache Storm Nimbus and Apache Storm UI are vulnerable to a credential disclosure flaw because the getTopologyPageInfo operation merges the Nimbus daemon configuration with the topology's configuration and returns it without redaction in the topology_conf field. This merged map can include sensit...
Astra Linux – Vulnerability in Chromium
A heap buffer overflow in the Media component of Google Chrome prior to version 149.0.7827.53 allowed a remote attacker who convinced a user to perform certain UI gestures to execute arbitrary code within a sandbox using a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in Split View in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted domain name. Chromium security severity: Low...
Astra Linux – Vulnerability in Chromium
Insufficient validation of untrusted input in the Input in Google Chrome before version 149.0.7827.103 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in WebKit2GTK
This issue has been resolved through improved UI handling. This issue is fixed in watchOS 8.7, tvOS 15.6, iOS 15.6, and iPadOS 15.6, as well as macOS Monterey 12.5. Visiting a website that contains malicious content may lead to UI spoofing...
Astra Linux – Vulnerability in Firefox
When sharing geolocation during an active WebRTC share, Firefox may reset the WebRTC sharing state in the user interface, resulting in a loss of control over the currently granted permissions. This vulnerability affects Firefox versions earlier than 85...