6650 matches found
CVE-2026-63137: Incorrect Authorization
Incorrect Authorization CWE-863 in Kibana can lead to privilege escalation via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. A user holding workflow edit permissions could cause scheduled workflow executions to run with the privileges of a different, higher-privilege...
PT-2026-84515
Name of the Vulnerable Software and Affected Versions hermes-agent versions prior to 0.18.3 Description A remote denial of service issue exists within the ACP Prompt Workflow component. The flaw is located in the HermesACPAgent.prompt function within the acp adapter/session.py file, where imprope...
CVE-2026-51769: Improper Access Control
Incorrect access control in the remoteCloudUpdateCheck function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to restart the cloud update check workflow via sending a crafted MQTT message to the csbroker component...
PT-2026-84382
Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description Incorrect authorization allows a user with workflow edit permissions to achieve privilege escalation. By exploiting incorrectly configured access control security levels, an attacker can cause...
CVE-2026-84288: Improper Resource Shutdown or Release
A vulnerability has been found in NousResearch hermes-agent up to 0.18.2. This affects the function HermesACPAgent.prompt of the file acpadapter/session.py of the component ACP Prompt Workflow. Such manipulation leads to denial of service. The attack may be performed from remote. The exploit has...
CVE-2026-51691
Incorrect access control in the setUploadSetting function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to manipulate the upload or flash workflow via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
CVE-2026-40464
NSP is vulnerable to a stored XSS due to insufficient validation or encoding of user-controlled input in a workflow application. An authenticated attacker with access to the workflow application could embed harmful code that runs when another user views the content...
CVE-2026-40464
The Nokia NSP is affected by a stored Cross-Site Scripting (XSS) vulnerability. The root cause is the insufficient validation or encoding of user-controlled input within a workflow application . An authenticated attacker with access to the application can embed malicious code that executes when v...
CVE-2026-40464 A Stored Cross-Site Scripting (XSS) Vulnerability in Nokia NSP
NSP is vulnerable to a stored XSS due to insufficient validation or encoding of user-controlled input in a workflow application. An authenticated attacker with access to the workflow application could embed harmful code that runs when another user views the content...
CVE-2026-40464 A Stored Cross-Site Scripting (XSS) Vulnerability in Nokia NSP
NSP is vulnerable to a stored XSS due to insufficient validation or encoding of user-controlled input in a workflow application. An authenticated attacker with access to the workflow application could embed harmful code that runs when another user views the content...
EUVD-2026-68373
NSP is vulnerable to a stored XSS due to insufficient validation or encoding of user-controlled input in a workflow application. An authenticated attacker with access to the workflow application could embed harmful code that runs when another user views the content...
CVE-2026-51691: Improper Access Control
Incorrect access control in the setUploadSetting function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to manipulate the upload or flash workflow via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
CVE-2026-40464: Improper Neutralization of Input During Web Page Generation
NSP is vulnerable to a stored XSS due to insufficient validation or encoding of user-controlled input in a workflow application. An authenticated attacker with access to the workflow application could embed harmful code that runs when another user views the content...
PT-2026-83703
NSP is vulnerable to a stored XSS due to insufficient validation or encoding of user-controlled input in a workflow application. An authenticated attacker with access to the workflow application could embed harmful code that runs when another user views the content...
CVE-2026-51691
The TOTOLINK T6 wireless dual-band Mesh router, specifically version 4.1.5cu.748_B20211015 , is affected by an incorrect access control vulnerability in the setUploadSetting function. This flaw allows unauthenticated attackers to manipulate the upload or flash workflow by sending a crafted POST r...
EUVD-2026-68586
Incorrect access control in the setUploadSetting function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to manipulate the upload or flash workflow via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
PT-2026-83852
Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the setUploadSetting function allows unauthenticated attackers to manipulate the upload or flash workflow. This is achieved by sending a crafted POST request to...
CVE-2026-51691
Incorrect access control in the setUploadSetting function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to manipulate the upload or flash workflow via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
CVE-2026-51689: Improper Access Control
Incorrect access control in the setUpgradeFW function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger firmware-upgrade workflow changes via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
