123 matches found
CVE-2026-85250
A flaw was found in Apache Camel's XPath component. This vulnerability can lead to information disclosure and unauthorized network requests when the component evaluates XML expressions using unhardened streaming parser configurations. A remote attacker can exploit this flaw by submitting speciall...
CVE-2026-0311
A server-side request forgery vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local unauthenticated user to make unauthorized network requests from host to internal services...
EUVD-2026-101676
A server-side request forgery vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local unauthenticated user to make unauthorized network requests from host to internal services...
kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink
A flaw was found in the Linux kernel's VXLAN Virtual Extensible LAN implementation. A local attacker, with CAPNETADMIN network administration capability in one network namespace, could exploit an incorrect privilege check in the rtnl changelink path. This allows the attacker to modify the...
CVE-2026-63045
A flaw was found in httpd. When configured as a forward proxy using the modproxyftp module, the server improperly validates the network address returned in a File Transfer Protocol FTP passive mode PASV response. A malicious FTP server can exploit this flaw by returning a crafted reply, forcing t...
CVE-2026-76730
An authentication bypass vulnerability exists in the PAPI protocol of HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to circumvent certain existing authentication...
CVE-2026-76730
An authentication bypass vulnerability exists in the PAPI protocol of HPE Networking Instant ON APs due to improper packet handling. This flaw allows an unauthenticated adjacent attacker to circumvent existing authentication controls and send unauthorized network traffic to the target device. Spe...
CVE-2026-76730 Improper PAPI Packet handling leads to unauthorized access in HPE Networking Instant ON APs
An authentication bypass vulnerability exists in the PAPI protocol of HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to circumvent certain existing authentication...
EUVD-2026-89349
An authentication bypass vulnerability exists in the PAPI protocol of HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to circumvent certain existing authentication...
CVE-2026-76726 Authentication Bypass Leading to Unauthorized Network Access in HPE Networking Instant ON API Endpoint
An authentication bypass vulnerability in the API endpoint of HPE Networking Instant ON could allow an unauthenticated remote attacker to bypass network access controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to obtain...
CVE-2026-76726
An authentication bypass vulnerability exists in the API endpoint of HPE Networking Instant ON . An unauthenticated remote attacker could bypass network access controls, provided certain preconditions outside of the attacker's control are met. Successful exploitation may result in unauthorized ac...
CVE-2026-76726 Authentication Bypass Leading to Unauthorized Network Access in HPE Networking Instant ON API Endpoint
An authentication bypass vulnerability in the API endpoint of HPE Networking Instant ON could allow an unauthenticated remote attacker to bypass network access controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to obtain...
PT-2026-102874
An authentication bypass vulnerability exists in the PAPI protocol of HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to circumvent certain existing authentication...
CVE-2026-75558 Botslab G980H Dashcams Use of Hard-coded Cryptographic Key
The Botslab G980H dash camera firmware uses a hard-coded cryptographic key and initialization vector to protect WiFi credentials communicated by the device. An attacker who obtains the protected credential and extracts the cryptographic material from the firmware could recover the WiFi password a...
openssh: OpenSSH: Tunnel forwarding restriction bypass
A flaw was found in OpenSSH's sshd component. The restrict keyword, designed to limit tunnel forwarding within the authorizedkeys file, was not correctly enforced for tunnel forwarding. This issue could allow a local attacker to bypass intended security restrictions, potentially leading to...
EUVD-2026-73895
Incorrect calculation of buffer size in Windows iSCSI allows an unauthorized attacker to execute code over a network...
Cross-site Request Forgery (CSRF)
Overview studio-42/elfinder is an open-source file manager for web, written in JavaScript using jQuery UI. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF in the netmount process. An attacker can force the application to mount an attacker-controlled FTP endpoin...
EUVD-2026-56725
Null pointer dereference in Windows iSCSI Target Service allows an unauthorized attacker to deny service over a network...
