79768 matches found
CVE-2026-10700
IBM Langflow OSS 1.0.0 through 1.8.4 contains multiple broken access control vulnerabilities in its file handling API that allow unauthorized access to user files.The /api/v1/files/images/flowid/filename endpoint does not enforce authentication or authorization checks, allowing unauthenticated...
SUSE CVE-2026-46614
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.23.0, the Fission router registers an internal-style route - /fission-function/ and /fission-function// - for every Function object,...
SUSE CVE-2026-49338
gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, the Subsonic API endpoints /rest/deletePlaylist.view and /rest/getPlaylist.view perform no per-resource authorization. Once authenticated as any user admin or not, an attacker can delete...
CVE-2026-15658 foreUP customer REST API allows unauthenticated endpoint access
A vulnerability in the foreUP customer REST API allows any authenticated, low-privilege customer to access an endpoint that returns the records of other users without checking that the caller owns the data associated with that record...
EUVD-2026-51159
A vulnerability in the foreUP customer REST API allows any authenticated, low-privilege customer to access an endpoint that returns the records of other users without checking that the caller owns the data associated with that record...
CVE-2026-16631
A flaw was found in publint. A local attacker can exploit an operating system OS command injection vulnerability by manipulating input processed by the childprocess.exec function. This allows the attacker to execute arbitrary commands on the system where publint is running, potentially leading to...
CVE-2026-59309
VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system...
EUVD-2026-51103
CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to read, write, or delete arbitrary account settings by exploiting exposed API endpoints that lack authorization checks. Attackers can generate valid encrypted EntAcctId values using the...
CVE-2026-54367 CentreStack < 17.2 Unauthenticated API Authorization Bypass
CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to read, write, or delete arbitrary account settings by exploiting exposed API endpoints that lack authorization checks. Attackers can generate valid encrypted EntAcctId values using the...
CVE-2026-59309 vCenter authentication-bypass vulnerability
VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system...
CVE-2026-59309
VMware vCenter Server contains a critical authentication bypass (CVSS 9.8) in the VMware Directory Service . An unauthenticated attacker with network access to vCenter can bypass authentication and gain unauthorized access to the management plane, which provides centralized control over ESXi host...
CVE-2026-59309
VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system...
EUVD-2026-51098
VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system...
CVE-2026-59309 vCenter authentication-bypass vulnerability
VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system...
Vulnerabilities are handled in GitLab through GitLab Inc.
GitLab Inc. has addressed several vulnerabilities in GitLab, particularly in versions prior to 19.0.5, 19.1.3, and 19.2.1, including those of the GitLab Enterprise Edition EE. These vulnerabilities concern various aspects of GitLab: - Improper access control, allowing authenticated users to acces...
EUVD-2026-50999
The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly validate that a one-time password presented in a cookie belongs to the identity being requested before returning front-end form submissions, allowing unauthenticated attackers to read other users' form submission data,...
CVE-2026-64389
A flaw was found in the Linux kernel's ksmbd component. A remote attacker could exploit a vulnerability in the NTLMv2 authentication process to modify a session key even when authentication fails. This bypasses security checks and could potentially lead to unauthorized access or session hijacking...
CVE-2026-14356 FleekDash V2 <= 2.6.2.2 - Missing Authorization to Authenticated (Subscriber+) Administrator Account Takeover via /users/{id} REST Endpoint
The FleekDash V2 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...
nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw
A flaw in the Node.js Permission Model allows attackers to bypass --permission restrictions, enabling unauthorized read or write access to files and directories...
CVE-2026-64388
A flaw was found in the Linux kernel's Server Message Block SMB client. When mounting filesystems using SMB3 POSIX Extensions, modifications to file ownership chown and group chgrp were not correctly applied on the server unless specific mount options were also enabled. This could allow a local...