475460 matches found
CVE-2026-73490
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept...
CVE-2026-73430
Russh is a Rust SSH client & server library. Prior to 0.62.4, an unauthenticated SSH client can cause a denial of service by sending SSHMSGKEXECDHINIT with a 32-byte all-zero QC value. Curve25519Kex::serverdh in russh/src/kex/curve25519.rs accepts the all-zero peer public value and computes an...
CVE-2026-13433 IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities
IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 ACS is vulnerable to downloading unverified product code when configured to update from an IBM i. A bad actor could use this vulnerablity to run compromised code on the ACS user's workstation...
MINI-M3WM-WWW8-867H
Bulletin has no description...
MINI-2752-Q4R4-CM23
Bulletin has no description...
MINI-5X8Q-H923-P7G2
Bulletin has no description...
MINI-82JX-74WC-89R7
Bulletin has no description...
CVE-2026-73306 Budibase: Account Enumeration via Login Lockout Response Differential
Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the failure counter in packages/worker/src/api/controllers/global/auth.ts only for existing users, while packages/worker/src/middleware/emailLockout.ts returned X-Account-Locked and...
CVE-2026-73301 Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings
Budibase is an open-source low-code platform. Prior to 3.39.25, the GET /api/global/groups endpoint in packages/worker/src/api/routes/global/groups.ts omitted auth.builderOrAdmin, allowing an authenticated BASIC role user to enumerate tenant groups, role mappings and user memberships, builder...
CVE-2026-69105
creationtimestamp| type| source ---|---|--- 2026-08-12 16:19:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/h5hgifcm5ha6z 2026-08-12 17:01:42+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msvm7cutg42t...
CVE-2026-65937
In WhatsUp Gold versions released before 2026.0.2, an authenticated attacker can bypass frontend controls and inject persistent script content...
CVE-2026-47234
Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, Session::setCookie logs full cookie values and Session::start logs the current session ID. In a real Admidio deployment this includes both the active session cookie and the persistent...
ECHO-8274-3DD3-6490
Bulletin has no description...
ECHO-57D5-1A2B-B3A3
Bulletin has no description...
CVE-2026-73290 RustFS: Anonymous ListObjectVersions bypasses RestrictPublicBuckets through the ListBucket fallback
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, an anonymous ListObjectVersions request in rustfs/src/storage/access.rs that lacks a direct bucket-policy grant falls back to an s3:ListBucket check and returns before the policyallowed path applies...
CVE-2026-73290
RustFS prior to 1.0.0-beta.12 contains an anonymous ListObjectVersions bypass where a ListBucket check is used if no bucket-policy grant exists, skipping the policy_allowed path (deny_anonymous_table_data_plane_if_needed and RestrictPublicBuckets). This allows buckets that permit anonymous listin...
EUVD-2026-57228
RustFS is a distributed object storage system built in Rust. RustFS AddServiceAccount in rustfs/src/admin/handlers/serviceaccount.rs accepts an attacker-controlled targetuser after only checking CreateServiceAccountAdminAction, passes it to newserviceaccount, and prepareserviceaccountauth sets...
CVE-2026-47234 Admidio writes session IDs and auto-login cookie values to application logs
Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, Session::setCookie logs full cookie values and Session::start logs the current session ID. In a real Admidio deployment this includes both the active session cookie and the persistent...
CVE-2026-47233
CVE-2026-47233 details an incomplete fix in Admidio where field_delete in modules/inventory.php validates only a CSRF token and does not enforce isAdministratorInventory(), allowing any logged-in user to delete non-system inventory fields. The related ItemField::delete() path lacks an admin check...