299862 matches found
CVE-2026-92567: Authorization Bypass Through User-Controlled Key
TDuck survey form through version 5.0 contains an authorization bypass vulnerability in the POST /user/form/data/update endpoint that allows authenticated users to overwrite other users' form submission data. Attackers can discover submission identifiers allocated in narrow ranges and modify...
CVE-2026-85385: Improper Neutralization of Input During Web Page Generation
Concrete CMS below 9.5.4 did not validate the user timezone value uTimezone on write and rendered it without output encoding on the Dashboard user management page, where Date::getTimezoneDisplayName returns any non-IANA value unchanged. A stored cross-site scripting payload saved in this field...
PT-2026-93352
A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credentials allowing execution of commands with root privileges on the device...
PT-2026-93959
Name of the Vulnerable Software and Affected Versions Cisco ISE affected versions not specified Description An issue exists that allows an authenticated remote attacker with high-privileged administrative credentials to execute arbitrary commands on the underlying operating system. This is caused...
CVE-2026-92461: Missing Authorization
yshop-crm through 2.1.3 contains a missing authorization vulnerability in the GET /admin-api/crm/flow/flow-users endpoint that allows any logged-in back-office user to access approval workflow data. Attackers can retrieve approval chain topology, step ordering, approver identifiers, and personal...
CVE-2026-92299: Missing Authorization
@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources via contextBridge without requiring an active getDisplayMedia picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop...
CVE-2026-85572: Exposure of Sensitive Information to an Unauthorized Actor
The Tutor LMS WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its lesson discussion content, allowing any authenticated user, such as a subscriber, to read comments from courses they are not enrolled in, including comments awaiting moderation...
PT-2026-93707
Name of the Vulnerable Software and Affected Versions yshop-crm versions prior to 2.1.4 Description An authorization failure exists in the 'GET /admin-api/system/user/page' endpoint because the @PreAuthorize annotation is commented out. This allows authenticated back-office users who lack the...
Linux Distros Unpatched Vulnerability : CVE-2026-89966
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mm/hugetlbcma: fix null nodemask dereference in hugetlbcmaallocfrozenfolio allocbuddyhugetlbfoliowithmpol can pass a NULL nodemask to allocfreshhugetlbfolio as...
PT-2026-94040
Name of the Vulnerable Software and Affected Versions PatrowlManager versions prior to 1.8.5 Description Improper access control exists in the user listing API endpoint because the authorization decorator is commented out. This allows authenticated attackers with low-privilege accounts to enumera...
PT-2026-93402
Name of the Vulnerable Software and Affected Versions apache-airflow-providers-fab versions prior to 3.9.0 Description Changing a user password via the Admin user-edit PATCH endpoint fails to invalidate existing database-backed sessions. This allows an attacker possessing a victim's session cooki...
PT-2026-93805
ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Blind SQL Injection The /api/events/search endpoint accepts a JSON body containing a sortBy array. The values in this array are concatenated directly into the SQL ORDER BY clause without any sanitization or parameterization...
CVE-2026-92584: Improper Neutralization of Input During Web Page Generation
AVideo through 29.0 current revision e01e41ecc contains a stored cross-site scripting vulnerability. The unauthenticated view-counter endpoint objects/videoAddViewCount.json.php reaches VideoStatistic::save, which writes the caller's User-Agent via getUserAgentInfo, which returns unrecognized age...
PT-2026-93812
Name of the Vulnerable Software and Affected Versions TDuck survey form versions prior to 5.1 Description An authorization bypass exists in the 'POST /user/form/data/update' endpoint. This issue allows authenticated users to overwrite form submission data belonging to other users. Attackers can...
CVE-2026-86462: Insufficient Session Expiration
Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions. An attacker who already holds a copy of the victim's session cookie keeps full access as that user after the password change, so th...
PT-2026-94101
Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.1 Description A stored cross-site scripting issue exists where the unauthenticated endpoint 'objects/videoAddViewCount.json.php' calls the VideoStatistic::save function. This process writes the caller's User-Agent...
CVE-2026-92455: Missing Authorization
yshop-crm through 2.1.3 fails to enforce authorization on the sendSms and sendMail endpoints in CrmCustomerController, allowing any authenticated back-office user to send SMS and email to arbitrary customers. Attackers can invoke POST /admin-api/crm/customer/send-sms and POST...
Linux Distros Unpatched Vulnerability : CVE-2026-89926
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: s390: Fix length check importwpinfo struct kvmhwbreakpoint::len is a u64 that is fully controlled by user space. This is then assigned to wpinfo-len, whic...
PT-2026-93896
Name of the Vulnerable Software and Affected Versions LiteLLM versions prior to 1.83.9 Description LiteLLM Proxy is susceptible to Server-Side Request Forgery SSRF, a condition where an attacker can induce the server to make requests to an unintended location. An authenticated caller with a valid...
