79502 matches found
EUVD-2026-63905
Headroom's LLM proxy derives the memory owner from the x-headroom-user-id request header. The header is read directly at several points in headroom/proxy/handlers/openai.py, including the chat completion and websocket paths, and nothing binds the value to the caller. A client can therefore name...
CVE-2026-59780
Apache CloudStack 's LDAP authentication plugin exposes sensitive LDAP provider configuration details through the listLdapConfigurations API, which is accessible by default to all standard user roles. This affects versions 4.2.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 . An attacker with ...
CVE-2026-65613 Apache CloudStack: Webhook Deliveries Incorrect Access
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting deliveries. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to versio...
CVE-2026-65613
Apache CloudStack versions 4.20.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 are affected by an access control flaw in the Webhook module . The issue allows an unauthorized actor to list and delete webhook deliveries , leading to exposure of sensitive information . The vulnerability require...
CVE-2026-19435
The Duplicate Post WordPress plugin (also titled "Copy & Delete Posts") before 1.5.6 lacks a capability check before returning post data. An authenticated user with a delegated role can read the content, metadata, and passwords of posts they are not authorized to access, including other users' pr...
EUVD-2026-63693
Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network...
EUVD-2026-63617
Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information over a network...
EUVD-2026-63691
Observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose information over a network...
EUVD-2026-63689
Server-side request forgery ssrf in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges over a network...
EUVD-2026-63688
Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized attacker to elevate privileges over a network...
EUVD-2026-63623
Server-side request forgery ssrf in Azure Data Factory allows an unauthorized attacker to disclose information over a network...
EUVD-2026-63619
Improper neutralization of argument delimiters in a command 'argument injection' in Azure Managed Instance for Apache Cassandra allows an unauthorized attacker to execute code over a network...
The vulnerability of the _validate_webhook_url() function in the mlflow/utils/validation.py file of the machine learning lifecycle management platform allows a attacker to perform an SSRF attack and gain unauthorized access to protected information.
The vulnerability of the validatewebhookurl function in the mlflow/utils/validation.py file of the machine learning lifecycle management platform is related to insufficient validation of server-side requests. Exploiting this vulnerability could allow an attacker to perform an SSRF attack and gain...
PT-2026-79458
Name of the Vulnerable Software and Affected Versions Nezha Monitoring versions 1.14.13 through 1.14.14 Nezha Monitoring versions 2.0.0 through 2.0.9 Description Nezha Monitoring fails to bind stream identifiers created by the CreateStream function in service/rpc/io stream.go to the user who...
Kibana 9.4.x < 9.4.5 / 9.5.x < 9.5.1 Incorrect Authorization (ESA-2026-124)
The version of Kibana installed on the remote host is 9.4.x prior to 9.4.5, or 9.5.x prior to 9.5.1. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-124 advisory. - Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user...
PT-2026-79440
In the Neptune connector, a user with access to Neptune through Athena Federated Query could gain access to properties in the Lambda supplying the compute for the connector. To remediate this issue, users should upgrade to aws-athena-query-federation v2026.30.1 or later...
The vulnerability of the Apache HTTP Server’s web server, related to the disclosure of information in the erroneous data area, allows attackers to gain unauthorized access to the protected information.
The vulnerability of the Apache HTTP Server is related to the disclosure of information in the erroneous data area. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...
PT-2026-79321
Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.2.0.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0 Description An issue in the LDAP authentication plugin allows authenticated users to access sensitive information while listing LDAP...
Oracle Business Intelligence Enterprise Edition (OAS 26.01) (August 2026 CSPU)
The version of Oracle Business Intelligence Enterprise Edition OAS 26.01.0.0.0 installed on the remote host is affected by multiple vulnerabilities as referenced in the August 2026 CSPU advisory. - Vulnerability in the Oracle BI Publisher product of Oracle Analytics component: Web Service API...
