56729 matches found
CVE-2026-103977 FileRise: Session-scoped TOTP rate limiting permits repeated verification attempts
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise stores failed TOTP verification attempts in $SESSION. An attacker who already possesses a target account's valid primary credential can restart the login workflow in a...
CVE-2026-71886
A flaw was found in Bouncy Castle. The OpenPGP certificate application programming interface API fails to verify whether a subkey possesses certification authority before validating third-party certifications or trust delegations. An attacker in possession of a restricted signing or encryption...
CVE-2026-106465
The NetX Secure DTLS server sends a HelloVerifyRequest carrying a freshly generated cookie, but never checks the cookie a client returns. The ClientHello parser copies the client's cookie bytes over the value the server issued, and the server then decides whether the client has been verified from...
CVE-2026-106465
The NetX Secure DTLS server is vulnerable to an authentication bypass and network amplification because it fails to properly verify cookies in a HelloVerifyRequest . The ClientHello parser incorrectly overwrites the server-issued cookie with client-provided bytes and validates verification based ...
DEBIAN-CVE-2026-97629
Description When NGINX Plus or NGINX Open Source is configured with sslsessioncache shared:name:size without an explicit sslsessionticketkey file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-determinist...
CVE-2026-110607
BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark orders paid by calling the PaymentController.testPostPay handler. Attackers can generate a payment log via /member/payment/load and request...
DEBIAN-CVE-2026-101019
Description NGINX JavaScript njs has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an...
CVE-2026-101019
Description NGINX JavaScript njs has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an...
EUVD-2026-101121
Description NGINX JavaScript njs has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an...
EUVD-2026-101113
Description When NGINX Plus or NGINX Open Source is configured with sslsessioncache shared:name:size without an explicit sslsessionticketkey file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-determinist...
CVE-2026-97629
The ngx_http_ssl_module in NGINX Plus , NGINX Open Source , and related F5 products (such as NGINX Instance Manager , F5 WAF for NGINX , and NGINX Gateway Fabric ) is vulnerable to a session forgery flaw. When configured with ssl_session_cache shared:name:size without an explicit ssl_session_tick...
CVE-2026-78231 Gitea blind SSRF through OpenID assertion verification
When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to the caller-supplied OpenID provider endpoint during verification. An attacker controls the destination and much of the form body, allowing interaction with internal HTTP services...
CVE-2026-78231 Gitea blind SSRF through OpenID assertion verification
When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to the caller-supplied OpenID provider endpoint during verification. An attacker controls the destination and much of the form body, allowing interaction with internal HTTP services...
CVE-2026-78231
The software Gitea is vulnerable to a blind Server-Side Request Forgery (SSRF) when OpenID sign-in is enabled. The root cause is that Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to a caller-supplied OpenID provider endpoint during verification. An attacker ...
CVE-2026-110652
ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vulnerability in the /downloadfile/:docid endpoint that allows remote attackers to bypass the private-IP request-filtering-agent by exploiting the isInJwtToken flag when JWT verification is disabled in...
CVE-2026-110607
The BizSpring Shop (specifically through commit cf22d39daaf1 ) contains a payment verification bypass vulnerability. The flaw resides in the PaymentController.testPostPay handler, allowing authenticated buyers to mark orders as paid without actual payment. An attacker can generate a payment log v...
CVE-2026-110607 BizSpring Shop through commit cf22d39daaf1 Payment Bypass via test_post_pay Endpoint
BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark orders paid by calling the PaymentController.testPostPay handler. Attackers can generate a payment log via /member/payment/load and request...
EUVD-2026-101235
BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark orders paid by calling the PaymentController.testPostPay handler. Attackers can generate a payment log via /member/payment/load and request...
CVE-2026-110607 BizSpring Shop through commit cf22d39daaf1 Payment Bypass via test_post_pay Endpoint
BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark orders paid by calling the PaymentController.testPostPay handler. Attackers can generate a payment log via /member/payment/load and request...
K000162606: NGINX ngx_http_ssl_module vulnerability CVE-2026-97629
Security Advisory Description When NGINX Plus or NGINX Open Source is configured with sslsessioncache shared: : without an explicit sslsessionticketkey file directive to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a...