Archive
5 March 2026
Vulnerabilities first published on this day (UTC), newest first.
495 results · Feed
-
Medium 4.3
Sensitive information disclosure due to improper access control. The following products are affected: Acronis Cyber Pro…
-
Medium 5.5
Sensitive information disclosure due to improper configuration of a headless browser. The following products are affect…
-
Medium 4.4
Credentials are not deleted from Acronis Agent after plan revocation. The following products are affected: Acronis Cybe…
-
Medium 4.3
Unauthorized data access due to insufficient access control validation. The following products are affected: Acronis Cy…
-
Medium 4.3
Unauthorized report deletion due to insufficient access control. The following products are affected: Acronis Cyber Pro…
-
High 7.3
Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Prote…
-
High 7.3
Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Prote…
-
Medium 4.3
Unauthorized modification of settings due to insufficient authorization checks. The following products are affected: Ac…
-
Medium 4.3
Unauthorized resource manipulation due to improper authorization checks. The following products are affected: Acronis C…
-
Medium 5.3
Denial of service due to insufficient input validation in authentication logging. The following products are affected: …
-
Medium 5.0
Local privilege escalation due to improper directory permissions. The following products are affected: Acronis Cyber Pr…
-
Medium 4.4
Information disclosure and manipulation due to improper authorization checks. The following products are affected: Acro…
-
Medium 6.5
Sensitive information disclosure due to improper authorization checks. The following products are affected: Acronis Cyb…
-
Medium 4.8
Unnecessary transmission of sensitive cryptographic material. The following products are affected: Acronis Cyber Protec…
-
High 7.1
Default credentials set for local privileged user in Virtual Appliance. The following products are affected: Acronis Cy…
-
Medium 6.3
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Prote…
-
Medium 6.3
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Prote…
-
High 8.1
Sensitive information disclosure and manipulation due to improper authentication. The following products are affected: …
-
Medium 4.3
Unauthorized resource manipulation due to improper authorization checks. The following products are affected: Acronis C…
-
Medium 4.4
Credentials are not deleted from Acronis Agent after plan revocation. The following products are affected: Acronis Cybe…
-
Medium 5.5
Sensitive information disclosure and manipulation due to insufficient authorization checks. The following products are …
-
High 7.3
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Prote…
-
High 7.8
Local privilege escalation due to insecure Unix socket permissions. The following products are affected: Acronis Cyber …
-
Medium 6.5
ePower epower.ie Insufficiently Protected Credentials
Charging station authentication identifiers are publicly accessible via web-based mapping platforms.
-
High 7.3
ePower epower.ie Insufficient Session Expiration
The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or …
-
High 7.5CVE-2026-27778 Public exploit
ePower epower.ie Improper Restriction of Excessive Authentication Attempts
The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, o…
-
Medium 5.3
Greenshift – animation and page builder blocks <= 12.8.3 - Unauthenticated Sensitive Information Exposure via Settings Backup
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 12.8.3 via the automated Settings Backup stored in a publicly accessible file. This makes it possible…
-
Critical 9.4
ePower epower.ie Missing Authentication for Critical Function
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discov…
-
Medium 6.5
Microsoft ACI Confidential Containers Information Disclosure Vulnerability
Initialization of a resource with an insecure default in Azure Compute Gallery allows an authorized attacker to disclose information over a network.
-
High 8.6
Payment Orchestrator Service Elevation of Privilege Vulnerability
Payment Orchestrator Service Elevation of Privilege Vulnerability
-
Critical 9.8
Microsoft Devices Pricing Program Remote Code Execution Vulnerability
Microsoft Devices Pricing Program Remote Code Execution Vulnerability
-
Medium 6.7
Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability
'.../...//' in Azure Compute Gallery allows an authorized attacker to elevate privileges locally.
-
Medium 6.7
Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability
Permissive regular expression in Azure Compute Gallery allows an authorized attacker to elevate privileges locally.
-
Low 3.3
Ettercap etterfilter ef_output.c add_data_segment out-of-bounds
A vulnerability has been found in Ettercap 0.8.4-Garofalo. Affected by this vulnerability is the function add_data_segment of the file src/ettercap/utils/etterfilter/ef_output.c of the component etterfilter. The manipulation leads to out-of-bounds read. Local…
-
High —
SageMaker Python SDK replaced eval() with safe parser in JumpStart search functionality
## Summary This advisory addresses the use of the search_hub() function within the SageMaker Python SDK's JumpStart search functionality. An actor with the ability to control query parameters passed to the search_hub() function could potentially provide malfo…
-
Medium 5.9
OpenClaw < 2026.2.12 - Webhook Authentication Bypass via Loopback remoteAddress Trust
OpenClaw versions prior to 2026.2.12 contain a vulnerability in the BlueBubbles (optional plugin) webhook handler in which it authenticates requests based solely on loopback remoteAddress without validating forwarding headers, allowing bypass of configured we…
-
Medium 5.5
OpenClaw < 2026.2.14 - Denial of Service via Large Base64 Media File Decoding
OpenClaw versions prior to 2026.2.14 decode base64-backed media inputs into buffers before enforcing decoded-size budget limits, allowing attackers to trigger large memory allocations. Remote attackers can supply oversized base64 payloads to cause memory pres…
-
High 7.5
OpenClaw < 2026.2.14 - Local File Inclusion via mediaPath Parameter in BlueBubbles Media Handling
OpenClaw versions prior to 2026.2.14 contain a local file inclusion vulnerability in BlueBubbles extension (must be installed and enabled) media path handling that allows attackers to read arbitrary files from the local filesystem. The sendBlueBubblesMedia fu…
-
High 8.8
OpenClaw < 2026.2.14 - Command Hijacking via Unsafe PATH Handling
OpenClaw versions prior to 2026.2.14 contain a command hijacking vulnerability that allows attackers to execute unintended binaries by manipulating PATH environment variables through node-host execution or project-local bootstrapping. Attackers with authentic…
-
High 7.5
OpenClaw < 2026.2.14 - Denial of Service via Unbounded URL-backed Media Fetch
OpenClaw versions prior to 2026.2.14 contain a denial of service vulnerability in the fetchWithGuard function that allocates entire response payloads in memory before enforcing maxBytes limits. Remote attackers can trigger memory exhaustion by serving oversiz…