6853 matches found
EUVD-2026-122829
An improper privilege management issue in the sharding subsystem of MongoDB Server may allow a user holding certain shard-level administrative privileges to cause persisted internal coordination state to be reprocessed with elevated internal authority. Because that state is trusted rather than...
CVE-2026-120814
An improper privilege management issue in the sharding subsystem of MongoDB Server may allow a user holding certain shard-level administrative privileges to cause persisted internal coordination state to be reprocessed with elevated internal authority. Because that state is trusted rather than...
CVE-2026-120822
The MongoDB Server may omit an authorization check on the resource targeted by a replication-related administrative command because the check is conditioned on a value from the client's own request. This vulnerability allows a user with backup and restore privileges to read and relocate collectio...
WordPress Simple Job Board - Unauthorized Data Access
The Simple Job Board plugin for WordPress is vulnerable to unauthorized data access due to insufficient authorization checking in the fetchquickjob function in all versions up to and including 2.10.8. This makes it possible for unauthenticated attackers to fetch arbitrary posts, which can be...
EUVD-2026-117171
Pocket ID: The client credentials grant allows any OIDC client to obtain tokens for arbitrary audiences...
PT-2026-140432
Name of the Vulnerable Software and Affected Versions AM CLUB mobile application affected versions not specified Description The application uses hard-coded MQTT credentials, which allows an authenticated attacker to connect to the MQTT broker. This can lead to unauthorized data access or the...
CVE-2021-27905
CVE-2021-27905 Apache Solr ReplicationHandler Server Side Request Forgery SSRF Hit Counter Apache Solr stands for Searching On Lucene with Replication is a free, open-source search engine based on the Apache Lucene library. Written in Java. Apache Solr has RESTful XML/HTTP and JSON APIs and clien...
WordPress JetFormBuilder – Hierarchical Select plugin <= 1.0.10 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Nikiforos Bafas in WordPress Plugin JetFormBuilder – Hierarchical Select versions = 1.0.10...
CVE-2026-123095
A flaw was found in mpv. A remote attacker who controls a media feed or webpage can exploit this vulnerability by injecting newline characters into playlist URLs processed by the bundled ytdlhook script. This allows the attacker to bypass URL safety checks and load arbitrary local files or shared...
openjdk: Enhance Preferences (Oracle CPU 2026-10)
A flaw was found in the OpenJDK Utility component. An unauthenticated attacker with local system access or the ability to supply data to affected application programming interfaces APIs can exploit this vulnerability. Successful exploitation can result in unauthorized data access, allowing an...
openjdk: Enhance jstatd (Oracle CPU 2026-10)
A flaw was found in the Serviceability component of OpenJDK. An unauthenticated remote attacker can exploit this issue across the network by supplying crafted data to exposed application programming interfaces APIs or by running untrusted code within a sandboxed Java environment. Successful...
openjdk: Enhance Preferences (Oracle CPU 2026-10)
A flaw was found in the OpenJDK Utility component. An unauthenticated attacker with local system access or the ability to supply data to affected application programming interfaces APIs can exploit this vulnerability. Successful exploitation can result in unauthorized data access, allowing an...
openjdk: Enhance jstatd (Oracle CPU 2026-10)
A flaw was found in the Serviceability component of OpenJDK. An unauthenticated remote attacker can exploit this issue across the network by supplying crafted data to exposed application programming interfaces APIs or by running untrusted code within a sandboxed Java environment. Successful...
openjdk: Enhance Preferences (Oracle CPU 2026-10)
A flaw was found in the OpenJDK Utility component. An unauthenticated attacker with local system access or the ability to supply data to affected application programming interfaces APIs can exploit this vulnerability. Successful exploitation can result in unauthorized data access, allowing an...
CVE-2026-62662
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 1.11.0 until 2.10.0, createTokenFromClientCredentials in backend/internal/service/oidcservice.go accepts the client-controlled resource parameter and embeds it directly in the access token aud...
CVE-2026-62662
Pocket ID versions 1.11.0 through 2.10.0 are vulnerable to an improper authorization flaw in the createTokenFromClientCredentials function within backend/internal/service/oidc_service.go. The root cause is that the system accepts a client-controlled resource parameter and embeds it into the acces...
CVE-2026-62662 Pocket ID: Client credentials grant allows any OIDC client to obtain tokens for arbitrary audiences
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 1.11.0 until 2.10.0, createTokenFromClientCredentials in backend/internal/service/oidcservice.go accepts the client-controlled resource parameter and embeds it directly in the access token aud...
CVE-2026-62662 Pocket ID: Client credentials grant allows any OIDC client to obtain tokens for arbitrary audiences
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 1.11.0 until 2.10.0, createTokenFromClientCredentials in backend/internal/service/oidcservice.go accepts the client-controlled resource parameter and embeds it directly in the access token aud...
CVE-2026-62662
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 1.11.0 until 2.10.0, createTokenFromClientCredentials in backend/internal/service/oidcservice.go accepts the client-controlled resource parameter and embeds it directly in the access token aud...
Pocket ID input validation error vulnerability
A security vulnerability exists in Pocket ID versions 1.11.0 through 2.10.0. This vulnerability arises because the createTokenFromClientCredentials function accepts a resource parameter controlled by the client and directly incorporates it into the access token audit statement. No validation is...