527 matches found
CVE-2026-86206
A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4...
CVE-2026-86206 Access control filter bypass allows unauthorised access to APIs
A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4...
CVE-2026-86206
A vulnerability in the N-able N-central internal API access control filter allows unauthorized access to internal APIs due to an access control bypass involving path confusion and forwarded header spoofing . The flaw arises because the Envoy proxy and Jetty web server interpret URIs with semicolo...
EUVD-2026-72023
A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4...
CVE-2026-86206 Access control filter bypass allows unauthorised access to APIs
A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4...
CVE-2026-86207 Authentication bypass leads to unauthorised access to N-central
An authentication bypass in N-central 2026.3 HF 3 leads to authentication bypass in internal only APIs...
CVE-2026-86207 Authentication bypass leads to unauthorised access to N-central
An authentication bypass in N-central 2026.3 HF 3 leads to authentication bypass in internal only APIs...
CVE-2026-86207
A high-severity authentication bypass exists in N-able N-central versions prior to 2026.3 HF 3 (version 2026.3.1.13). The flaw resides in the UserTwoFactorLogin function, where a RemoteException during legacy two-factor authentication fails to clear a session binding. By chaining this with a path...
CVE-2026-86206: Incomplete Filtering of Special Elements
A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4...
WordPress theme My Login plugin 7.0-7.1.15 - Subscriber+ Unauthorised Multisite Site Creation and Privilege Escalation vulnerability
Subscriber+ Unauthorised Multisite Site Creation and Privilege Escalation vulnerability discovered by Jakub Herman in WordPress Plugin Theme My Login versions 7.0-7.1.15...
CVE-2026-81583
The My Login WordPress plugin (versions 7.0-7.1.15 ) contains a vulnerability where it fails to enforce the network's registration settings during site signups on multisite installations . This flaw allows users with a subscriber account , and in some cases unauthenticated users , to create new s...
CVE-2026-81583 Theme My Login 7.0 - 7.1.15 - Subscriber+ Unauthorised Multisite Site Creation and Privilege Escalation
The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite installations, allowing users with a subscriber account, and unauthenticated users on some networks, to create new sites and be granted administrator over them...
CVE-2026-81583 Theme My Login 7.0 - 7.1.15 - Subscriber+ Unauthorised Multisite Site Creation and Privilege Escalation
The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite installations, allowing users with a subscriber account, and unauthenticated users on some networks, to create new sites and be granted administrator over them...
EUVD-2026-66418
The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credentials within the application. The generation mechanism uses the 'badgenumber' parameter as the HMAC private key, the value of which remains static and is accessible via the API usin...
Linux Distros Unpatched Vulnerability : CVE-2026-65183
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Time-of-check Time-of-use TOCTOU Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the...
CVE-2026-66797
Apache CloudStack versions 4.15.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 are vulnerable to an improper access control flaw in the annotation functionality . The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is provided but fail to honor the resul...
CVE-2026-19782
The WPS Bidouille WordPress plugin before 1.33.5 does not have proper authorisation checks in an AJAX action, allowing any authenticated user, such as a subscriber, to retrieve the email addresses of all registered users...
EUVD-2026-60546
Mahara before 25.04.5 and 26.04.0 is vulnerable to artefacts being accessible to others under certain circumstances when the file path to an artefact in a page is manipulated...
CVE-2026-75051
JetBrains YouTrack before 2026.2.17917 allowed an authenticated low-privileged user to transfer projects between organisations, breaking tenant isolation. CVSS 8.1 (High) reflects high confidentiality and integrity impact. Upgrade to YouTrack 2026.2.17917 or later to remediate.