299823 matches found
CVE-2026-86683: Improper Input Validation
ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings...
PT-2026-97406
Name of the Vulnerable Software and Affected Versions Plex Media Server versions prior to 1.43.3.10861 Description An administrative user can write arbitrary files that may be executed upon loading. This occurs because the TranscoderH264Options preference is appended verbatim to the x264 option...
CVE-2026-96655: Server-Side Request Forgery (SSRF)
Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter...
CVE-2026-94367
OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 contains an OS command injection vulnerability in recbackup. An authenticated administrator can supply crafted backup-area configuration input that is passed to a shell command, allowing commands to execute with the privileges of the nvr...
CVE-2026-57576 plone.app.dexterity and plone.app.contenttypes have a Denial of Service due to excessive title or description length
plone.app.dexterity is a content-type system for the Plone content management system, and plone.app.contenttypes provides Plone’s Dexterity-based content types. Plone.app.dexterity versions through 3.2.2, 4.0.0 through 4.1.2, and 5.0.0, and plone.app.contenttypes versions through 3.0.11, 4.0.0...
CVE-2026-57576 plone.app.dexterity and plone.app.contenttypes have a Denial of Service due to excessive title or description length
plone.app.dexterity is a content-type system for the Plone content management system, and plone.app.contenttypes provides Plone’s Dexterity-based content types. Plone.app.dexterity versions through 3.2.2, 4.0.0 through 4.1.2, and 5.0.0, and plone.app.contenttypes versions through 3.0.11, 4.0.0...
CVE-2026-18156
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to bypass security controls by forging user identities due to improper authorization...
CVE-2026-18162
The IBM Financial Transaction Manager (FTM) for RedHat OpenShift is impacted by a vulnerability that could allow a remote attacker to execute arbitrary code . The root cause is the improper neutralization of user-controlled input within the new Function constructor . The vulnerability has a CRITI...
CVE-2026-18156
IBM Financial Transaction Manager (FTM) for RedHat OpenShift is affected by CVE-2026-18156 , where a remote authenticated attacker could bypass security controls by forging user identities due to improper authorization (CWE-862 ). The vulnerability has a CVSS base score of 6.5 . Affected versions...
CVE-2026-95819 anirbandutta9 College-Notes-Gallery login.php sql injection
A vulnerability has been found in anirbandutta9 College-Notes-Gallery up to 8c1cf3d98f30982d069c88ca172612c001eb39f6. Affected by this vulnerability is an unknown functionality of the file login.php. Such manipulation of the argument user/pass leads to sql injection. The attack may be performed...
CVE-2026-95819
A SQL injection vulnerability exists in the login.php file of anirbandutta9 College-Notes-Gallery (up to commit 8c1cf3d98f30982d069c88ca172612c001eb39f6). The root cause is the improper handling of the user/pass arguments, allowing for remote manipulation. The exploit has been disclosed to the pu...
CVE-2026-18131
IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to a cross-site scripting (XSS) flaw due to the improper neutralization of HTML input (CWE-79). This vulnerability could allow a remote attacker to execute arbitrary JavaScript in an authenticated user's browser. The impac...
Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update
An update for kernel is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...
CVE-2026-75101
An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed any authenticated user of the instance to read the raw diff or patch of pull requests in private repositories without authorization. Access tokens for raw pull request diffs and patches were scoped to th...
CVE-2026-75101 Authorization bypass vulnerability in GitHub Enterprise Server allowed reading of private pull request diffs and patches via repository name collision
An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed any authenticated user of the instance to read the raw diff or patch of pull requests in private repositories without authorization. Access tokens for raw pull request diffs and patches were scoped to th...
CVE-2026-75101
An authorization bypass vulnerability exists in GitHub Enterprise Server (versions prior to 3.22) due to a repository name collision flaw. Access tokens for raw pull request diffs and patches were incorrectly scoped to the repository name and pull request number rather than a globally unique iden...
CVE-2026-75101 Authorization bypass vulnerability in GitHub Enterprise Server allowed reading of private pull request diffs and patches via repository name collision
An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed any authenticated user of the instance to read the raw diff or patch of pull requests in private repositories without authorization. Access tokens for raw pull request diffs and patches were scoped to th...
Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service
Summary Tinyauth's login rate-limit bookkeeping can enter a global lockdown mode when its in-memory login-attempt map reaches 256 distinct identifiers. Because unauthenticated POST /api/user/login requests for unknown usernames are recorded in this same map, a remote unauthenticated attacker can...
GHSA-9XHM-W3WJ-XHQH Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service
Summary Tinyauth's login rate-limit bookkeeping can enter a global lockdown mode when its in-memory login-attempt map reaches 256 distinct identifiers. Because unauthenticated POST /api/user/login requests for unknown usernames are recorded in this same map, a remote unauthenticated attacker can...
