2060 matches found
CLSA-2026-1782089809 TuxCare security update for uuid (2 CVEs)
TuxCare rebuilt uuid to address 2 CVEs. Fixed in 3.4.0-tuxcare.2...
CLSA-2026-1779065185 TuxCare security update for uuid (1 CVE)
TuxCare rebuilt uuid to address 1 CVE. Fixed in 8.3.2-tuxcare.1...
CLSA-2026-1778805966 TuxCare security update for uuid (2 CVEs)
TuxCare rebuilt uuid to address 2 CVEs. Fixed in 11.0.5-tuxcare.1...
GHSA-V5MV-P594-2X33
creationtimestamp| type| source ---|---|--- 2026-08-04 01:31:43+00:00| seen| https://gist.github.com/alon710/aa0d8e0a2033bd155210db761c2f4b38...
PT-2026-67665
Name of the Vulnerable Software and Affected Versions The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin versions prior to 1.8.2 Description An unauthenticated user can upload arbitrary files because the plugin fails to validate th...
PT-2026-67412
Admidio before 5.0.11 fails to validate target organization membership in role handlers, allowing authenticated role administrators to delete, activate, deactivate, or edit roles belonging to other organizations. Attackers can supply a role UUID from another organization to groups roles.php...
EUVD-2026-52008
The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parserpcmsg subsys/net/lib/ocpp/ocppj.c using a hand-rolled helper, extractstringfield, that copied the message's uid and action fields with strncpyoutbuf, token + 1, outlen - 1 and then scanned the result with...
CVE-2026-44100 JupiCore charging point reconfiguration without auth
The CHARX JupiCore service allows an unauthenticated remote attacker to reconfigure charging points. This can lead to disclosure of charging point UIDs, Denial-of-Service and files tampering...
EUVD-2026-50214
A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name instead of a unique identifier. An attacker with client management privileges could bypass security policies by joining a group with a matching name in a...
PT-2026-65741
Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the client policy enforcement mechanism where the system verifies group membership using names rather than unique identifiers. An attacker possessing client management...
Improper Restriction of Security Token Assignment
Overview Affected versions of this package are vulnerable to Improper Restriction of Security Token Assignment via the /upload/file endpoint accepting any valid panel-signed JWT containing serveruuid, useruuid, and uniqueid claims without verifying the token's intended purpose. An attacker can...
Improper Restriction of Security Token Assignment
Overview pterodactyl/panel is a game management panel. Affected versions of this package are vulnerable to Improper Restriction of Security Token Assignment via the /upload/file endpoint accepting any valid panel-signed JWT containing serveruuid, useruuid, and uniqueid claims without verifying th...
Improper Restriction of Security Token Assignment
Overview Affected versions of this package are vulnerable to Improper Restriction of Security Token Assignment via the /upload/file endpoint accepting any valid panel-signed JWT containing serveruuid, useruuid, and uniqueid claims without verifying the token's intended purpose. An attacker can...
CVE-2026-54593
Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained serveruuid, useruuid, and uniqueid claims without checking the token's intended purpose;...
GHSA-8R6W-3QQ5-4P4R Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions
Summary A privilege escalation vulnerability exists in the Wings /upload/file endpoint due to insufficient validation of panel-signed JWTs. Wings accepts any valid panel-signed JWT containing serveruuid, useruuid, and uniqueid, regardless of the token’s intended purpose. Because the Panel issues...
MINI-JMXV-PVRR-9P4J
Bulletin has no description...
MINI-R43V-7GM6-83JC
Bulletin has no description...
CVE-2021-32086
Quest KACE Systems Deployment Appliance (SMA) version 11.0.273 is vulnerable to a cryptographic flaw because it utilizes a hardcoded symmetric encryption key to protect secrets within MySQL databases. This key is shared across all installations, meaning an attacker who gains access to the MySQL s...
PT-2026-65308
An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. It uses a hardcoded symmetric encryption key to encrypt secrets in the MySQL databases. This key is not unique for each installation. An attacker that gains access to the MySQL server or a backup files can decrypt th...