128057 matches found
SUSE CVE-2025-64513
Milvus is an open-source vector database built for generative AI applications. An unauthenticated attacker can exploit a vulnerability in versions prior to 2.4.24, 2.5.21, and 2.6.5 to bypass all authentication mechanisms in the Milvus Proxy component, gaining full administrative access to the...
EUVD-2026-51333
MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated remote attackers to hijack authenticated administrator sessions by exploiting an unconditional early return in the CheckWebServerOriginName function within webserver.js when...
CVE-2026-14928: Exposure of Sensitive Information to an Unauthorized Actor
The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership checks before returning support-ticket content in a nonce-gated search handler, allowing any authenticated user Subscriber and above to read the subject and full message body of every other user's support...
[20260809] - Core - Improper ACL checks when injection schema.org contact data
An improper access check injects contact information for unaccessible contact items into schema.org snippets...
PT-2026-66749
A Cross-Site Request Forgery CSRF vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attributes allows an attacker to send unauthorized requests in the context of an authenticated user, leading to unauthorized administrative actions,...
The vulnerability of the Python library for interacting with git repositories, GitPython, is related to an incorrect limitation on the path name for the restricted access directory. This allows a malicious actor to gain unauthorized access to protected information.
The vulnerability of the Python library for interacting with git repositories, GitPython, is related to an incorrect restriction on the path name for the restricted access directory. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...
GitLab 16.6 < 19.0.5 / 19.1 < 19.1.3 / 19.2 < 19.2.1 (CVE-2026-6336)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthoriz...
The vulnerability of the Grafana monitoring and surveillance platform lies in the improper restriction of the path name to the restricted access catalog, which allows a intruder to gain unauthorized access to protected information.
The vulnerability of the Grafana monitoring and observation platform is related to an incorrect restriction on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...
The vulnerability of the Python library for working with Git Dulwich repositories lies in the incorrect pathname limitation for the restricted access directory. This allows attackers to gain unauthorized access to protected information.
The vulnerability of the Python library for working with Git Dulwich repositories is related to an incorrect limitation on the path name for the restricted access directory. Exploiting this vulnerability could allow a malicious individual to gain unauthorized access to protected information...
The vulnerability of the software for implementing the hypertext environment MediaWiki, related to the lack of protection for operational data, allows a violator to gain unauthorized access to protected information.
The vulnerability of the software for implementing the hypertext environment MediaWiki is related to the lack of protection for operational data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...
CVE-2026-18206: Improper Input Validation
A flaw was found in the keycloak-services component of Keycloak, which provides identity and access management services. The issue occurs when a realm administrator uses a wildcard domain like .example.com to restrict which hosts can register or update clients. Due to improper validation, the...
CVE-2026-18203: Incorrect Authorization
A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution. When a group policy is set to extend permissions to child groups, the system incorrectly uses a simple text-based prefix check to verify group membership. This allows a user who belongs ...
CVE-2025-67651: Cross-Site Request Forgery (CSRF)
A Cross-Site Request Forgery CSRF vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attributes allows an attacker to send unauthorized requests in the context of an authenticated user, leading to unauthorized administrative actions,...
PT-2026-66739
The MailerPress – Newsletter, email marketing & AI automation plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the mailerpress/v1/contact endpoint in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to...
PT-2026-66724
A flaw was found in the OIDC token introspection endpoint of the keycloak-services component. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when a confidential client, configured to receive signed JWT...
The vulnerability of the Sqlalchemy mako Python template library relates to incorrect path name restrictions for restricted access directories, allowing attackers to gain unauthorized access to protected information.
The vulnerability of the Sqlalchemy mako Python template library relates to an incorrect restriction on the path name of the restricted directory. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...
The vulnerability of the Portainer container management platform, related to the improper implementation of authentication algorithms, allows attackers to circumvent security restrictions and gain unauthorized access to protected information.
The vulnerability of the Portainer container management platform is related to the improper implementation of the authentication algorithm. Exploiting this vulnerability allows an attacker to bypass security restrictions and gain unauthorized access to protected information...
The vulnerability of the Python library for working with Git Dulwich repositories lies in the incorrect pathname limitation for the restricted access directory. This allows attackers to gain unauthorized access to protected information.
The vulnerability of the Python library for working with Git Dulwich repositories is related to an incorrect limitation on the path name for the restricted access directory. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...
The vulnerability of the NetworkClient component of the Apache Kafka messaging broker allows a attacker to gain unauthorized access to confidential information.
The vulnerability of the NetworkClient component in the Apache Kafka messaging broker is related to the disclosure of information through Server Logs. Exploiting this vulnerability could allow an attacker to gain unauthorized access to confidential information...
CVE-2026-18215: Improper Authentication
Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization tenant. A flaw was discovered where this restriction is ignored when using the token exchange feature. This means an attacker with a valid Microsoft token from a completely...