120016 matches found
VulnCheck KEV: CVE-2026-63520
Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network...
CVE-2026-5006 Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths
A vulnerability was identified in HashiCorp Vault and Vault Enterprise “Vault” such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths. An attacker who can control the referenced identity value may include...
CVE-2026-61419
Dell ThinOS 10, versions prior to 260510.2518, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access...
EUVD-2026-65086
Dell ThinOS 10, versions prior to 260510.2518, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access...
CVE-2026-61419
Dell ThinOS 10, versions prior to 260510.2518, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access...
CVE-2026-61419
Dell ThinOS 10 versions prior to 2605_10.2518 are affected by an Improper Access Control vulnerability. A low-privileged attacker with local access can exploit this flaw to gain unauthorized access , resulting in high impact to confidentiality, integrity, and availability (CVSS 3.1: 7.8 HIGH , ve...
CVE-2026-71933
Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple syslog functions. The vulnerability is caused by missing authorization checks. A remote attacker can trigger these vulnerabilities via crafted requests to modify configuration, restart services, save...
EUVD-2026-64992
Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple syslog functions. The vulnerability is caused by missing authorization checks. A remote attacker can trigger these vulnerabilities via crafted requests to modify configuration, restart services, save...
tmp: path Traversal via unsanitized prefix/postfix enables directory escape
A flaw was found in tmp, a temporary file and directory creator for Node.js. This path traversal vulnerability allows an attacker to escape the intended temporary directory. By providing specially crafted input to the prefix, postfix or dir options, an attacker can create files outside the...
tmp: path Traversal via unsanitized prefix/postfix enables directory escape
A flaw was found in tmp, a temporary file and directory creator for Node.js. This path traversal vulnerability allows an attacker to escape the intended temporary directory. By providing specially crafted input to the prefix, postfix or dir options, an attacker can create files outside the...
aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade
A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability allows a remote attacker to perform HTTP request smuggling due to an edge case in the WebSocket upgrade procedure. When a WebSocket upgrade request includes a body, the parser may switch protocols before...
CVE-2026-21752
HCL Hive is affected by a use of vulnerable third-party components which could allow an attacker unauthorized access or compromise of the system by exploiting publicly documented security flaws...
CVE-2026-77915 rConfig Core 8.0.0 < 8.2.10 Unauthorized Admin Registration via web.php
rConfig Core 8.0.0 before 8.2.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate bare Auth::routes call in routes/web.php that re-enables the POST /register route after it was...
Moderate: Red Hat Security Advisory: grafana security, bug fix, and enhancement update
An update for grafana is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...
grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default
A flaw in Grafana's Auth Proxy IPv6 allow-list incorrectly defaults to a broad /32 subnet mask instead of a strict /128. This misconfiguration allows remote attackers to bypass access restrictions, potentially leading to unauthorized access and data manipulation...
CVE-2026-62313
A flaw was found in Incus, a system container and virtual machine manager. A user within a project configured to forbid non-isolated containers can bypass this restriction by omitting a specific security setting security.idmap.isolated. This allows the creation of containers that share the host's...
CVE-2026-21752 HCL Hive is affected by a use of vulnerable third-party components
HCL Hive is affected by a use of vulnerable third-party components which could allow an attacker unauthorized access or compromise of the system by exploiting publicly documented security flaws...
CVE-2026-21752
HCL Hive is affected by its use of vulnerable third-party components , which could allow a remote attacker to gain unauthorized access or compromise the system by exploiting publicly documented security flaws. The CVSS 3.1 score is 7.5 (HIGH) , with a High confidentiality impact over a network wi...
EUVD-2026-64917
HCL Hive is affected by a use of vulnerable third-party components which could allow an attacker unauthorized access or compromise of the system by exploiting publicly documented security flaws...
Security Bulletin: Langflow is affected by security vulnerabilities in Model Context Protocol features
Summary Langflow uses Model Context Protocol MCP features to manage external server connections, project access, file resources, and local client integration. Weaknesses in MCP command and configuration validation, authentication and authorization enforcement, file resource handling, and request...