452 matches found
CVE-2026-65985 FUXA: SSRF hardening for `device-webapi-request`
FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, the device-webapi-request Socket.IO handler in server/runtime/index.js permits an authenticated non-admin runtime user to control property.address, causing the FUXA server to issue an outbound HTTP or...
EUVD-2026-55220
A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQQUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events DEVICEBROWSE, HOSTINTERFACES, DEVICETAGSREQUEST, et...
CLSA-2026-1775608289 TuxCare security update for ini (1 CVE)
TuxCare rebuilt ini to address 1 CVE. Fixed in 1.3.3-tuxcare.1...
EUVD-2026-49248
Contributor Cross Site Scripting XSS in Gallery PhotoBlocks = 1.3.3 versions...
CVE-2026-66448
WordPress Gallery PhotoBlocks plugin ≤ 1.3.3 has a Cross Site Scripting (XSS) vulnerability in contributor contexts. Affected product: Gallery PhotoBlocks plugin for WordPress (versions up to 1.3.3). Root cause details are not provided in the documents. CVSSv3.1 base score 6.5 (AV:N/AC:L/PR:L/UI:...
CVE-2026-66448 WordPress Gallery PhotoBlocks plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Gallery PhotoBlocks = 1.3.3 versions...
EUVD-2026-48138
Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names = 1.3.3 versions...
CVE-2026-65537
Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names = 1.3.3 versions...
CVE-2026-65537
CVE-2026-65537 concerns a WordPress plugin, Cyr to Lat reloaded – transliteration of links and file names , affected in versions
OPENSUSE-SU-2026:11297-1 oras-1.3.3-2.1 on GA media
These are all security issues fixed in the oras-1.3.3-2.1 package on the GA media of openSUSE Tumbleweed...
CVE-2026-58518
Cross-Site request forgery CSRF vulnerability in The Wikimedia Foundation Mediawiki - RedirectManager Extension allows Cross Site Request Forgery. This issue affects Mediawiki - RedirectManager Extension: from before 1.3.3...
OPENSUSE-SU-2026:11123-1 jupyter-nbclassic-1.3.3-2.1 on GA media
These are all security issues fixed in the jupyter-nbclassic-1.3.3-2.1 package on the GA media of openSUSE Tumbleweed...
CVE-2026-41049
Incorrect caching of authentication between different users of the qSnapper dbus service before version 1.3.3 allowed any local attacker to use dbus functions after a privileged users has authenticated for them...
EUVD-2026-38275
Incorrect caching of authentication between different users of the qSnapper dbus service before version 1.3.3 allowed any local attacker to use dbus functions after a privileged users has authenticated for them...
CVE-2026-41049 Caching of Authentication allows Authentication Bypass between users in qSnapper
Incorrect caching of authentication between different users of the qSnapper dbus service before version 1.3.3 allowed any local attacker to use dbus functions after a privileged users has authenticated for them...
CVE-2026-41048 Caching of Authentication allows Authentication Bypass in qSnapper
Incorrect caching of authentication between different polkit methods in qSnapper before version 1.3.3 allowed a local attacker to use functions like "restore from snapshot" even if only allowed to do "delete snapshot"...
CVE-2026-41048 Caching of Authentication allows Authentication Bypass in qSnapper
Incorrect caching of authentication between different polkit methods in qSnapper before version 1.3.3 allowed a local attacker to use functions like "restore from snapshot" even if only allowed to do "delete snapshot"...
CVE-2026-41047
The CVE affects qSnapper prior to version 1.3.3, where the snapshot diff functionality permits a local attacker to access information that should be protected due to lack of authentication. This is a local-privilege-related information leak (confidentiality impact). The baseline CVSS measures a M...
CVE-2026-41047 Information leak via “diff” methods in qSnapper
Lack of authentication when using the "snapshot diff" functions in qSnapper before version 1.3.3 allowed a local attacker to see otherwise read protected information...