25,529 results · Clear filters · Feed
-
Critical 10.0
Apache Juneau: REST client forwards credentials to a different origin when following HTTP redirects
Insufficiently Protected Credentials vulnerability in Apache Juneau. The Apache Juneau RestClient followed HTTP redirects while keeping credential headers from the original request, so a server that redirected the client to a different host or port, or from H…
-
Critical 10.0
Apache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaults
Generation of Error Message Containing Sensitive Information vulnerability in Apache Juneau. The REST server sends the internal exception class and message to clients in a "Thrown" response header on every error response, and can include internal exception me…
-
Critical 10.0
Apache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errors
Insertion of Sensitive Information into Log File vulnerability in Apache Juneau. The default REST server call logger records request headers for requests that end in a server error, without redacting them. Any client able to cause a server error gets headers …
-
Critical 10.0
Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body override
Cross-Site Request Forgery (CSRF) vulnerability in Apache Juneau. The REST server accepts a "content" query parameter that replaces the request body, and this is enabled by default on every HTTP method, including GET. A cross-site link can therefore deliver a…
-
Critical 10.0
Apache Juneau: Unsafe reflection allows attacker-controlled class initialization during parsing
Improper control of dynamically-loaded code vulnerability in Apache Juneau. When Apache Juneau parses a value into a property of type java.lang.Class (including parameterized forms), the default class swap loaded the named class with initialization enabled, s…
-
Critical 9.8CVE-2026-100109 Public exploit
Security For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation via usfw_create_temporary_user
The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role, allowing unauthenticated att…
-
Critical 9.4CVE-2026-123025 Public exploit
An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-…
-
Critical 9.3
IVPAY payments <= 1.0.8 - Unauthenticated SQLi via 'payment_id' Parameter
The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to rea…
-
Critical 9.8
All In One Login 2.4.0 - 2.4.1 - Unauthenticated Account Takeover via Email OTP Brute Force
The All In One Login WordPress plugin before 2.5.0 does not adequately restrict the number of attempts that can be made against the short numeric code used by its default-enabled passwordless email login, and does not feed those failed attempts into its own b…
-
Critical 9.8
In the NAS message handler, improper validation of the length field in NAS message causes memory corruption
-
Critical 9.8
In the NR RRC component, improper handling of messages before authentication triggers a data abort, which leads to a de…
-
Critical 9.1
Improper handling of messages before AS security activation can cause unexpected behavior
-
Critical 9.1
Improper permission handling during buffer operations allows untrusted applications to create memory mappings with inap…
-
Critical 9.1
Insufficient validation of length fields in the GNSS firmware loader can result in kernel‑memory corruption.
-
Critical 9.1
Insufficient length validation in the GNSS firmware loader may lead to corruption of kernel memory.
-
Critical 9.8
In the Samsung Exynos ENN NeuralNetworks HAL, improper input validation during request processing can cause memory corr…
-
Critical 9.8
Out-of-bounds memory access in a device driver due to improper resource state tracking.
-
Critical 9.1
In the Samsung Exynos GPU driver, improper synchronization during buffer object creation and closing can lead to memory…
-
Critical 9.8
In the LTE RRC component, improper handling of messages before authentication triggers a data abort, which leads to a d…
-
Critical 9.8
In the Exynos modem's IMS stack, Out of Bound access occurs due to improper validation.
-
Critical 9.2
In G4KLX DStarGateway and F4FXL DStarGateway before 7b75de6, dstarCallsignToAPRS in APRSUtils.cpp has an integer underf…
-
Critical 9.1
Kyverno 1.18.0 before 1.19.2 verifyImages Cache Signature Verification Bypass
Kyverno 1.18.0 before 1.19.2 contains a signature verification bypass in verifyImages because cached verification results are keyed by the image reference string (such as a tag) rather than bound to the verified digest, so cache hits skip signature and attest…
-
Critical 9.9
Kyverno 1.17.0 before 1.19.2 Cross-Namespace Privilege Escalation via NamespacedMutatingPolicy
Kyverno from 1.17.0 before 1.19.2 contains a privilege escalation vulnerability that allows namespace-scoped tenants to modify resources in other namespaces through NamespacedMutatingPolicy targetMatchConstraints.expression CEL output lacking namespace checks…
-
Critical 9.9
Kyverno 1.16.0 before 1.19.2 Path Traversal in Namespaced CEL Policies via resource argument
Kyverno from 1.16.0 before 1.19.2 fails to validate path segments in the resource argument of resource.get() and resource.post(), allowing namespaced CEL policies to escape their namespace. Tenants who can create a NamespacedValidatingPolicy can insert .. seg…
-
Critical 9.9
Kyverno 1.19.1 before 1.19.2 Privilege Escalation via Policy apiCall urlPath
Kyverno from 1.19.1 before 1.19.2 validates a Policy's context.apiCall urlPath after cleaning it but executes the raw path, whose fragment or query the Kubernetes client discards. A namespace-scoped user who can create a Policy can hide ../ segments behind # …
-
Critical 9.9
Kyverno 1.17.0 before 1.19.2 Privilege Escalation via CleanupPolicy Context Loader
Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace admins to escape namespace confinement because the cleanup controller builds its context loader with a nil policy. Attackers can create a namespaced Cleanup…
-
Critical 9.9
Kyverno 1.17.0 before 1.19.2 Cross-Namespace Resource Overwrite via NamespacedMutatingPolicy
Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace tenants to overwrite resources in other namespaces via NamespacedMutatingPolicy mutate-existing targetMatchConstraints.expression. Attackers can return a CE…
-
Critical 9.8
Kyverno before 1.19.2 Privilege Escalation via Generate Rule Permission Check
Kyverno before 1.19.2 contains a privilege escalation vulnerability that allows namespace admins to create resources beyond their RBAC because generate-rule admission checks verify the controller's permissions, not the author's. Attackers can create a namespa…
-
Critical 10.0CVE-2026-122051 Public exploit
Edimax BR-6208AC mp command injection
A flaw has been found in Edimax BR-6208AC 1.32. Affected by this vulnerability is an unknown functionality of the file /goform/mp. Executing a manipulation can lead to command injection. The attack may be launched remotely. The exploit has been published and …
-
Critical 9.6
Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.2.0 until 2.12.0, SendEmailVerification uses the token model in backend/internal/model/email_verification_token.go to bind an email-verification token only…
-
Critical 9.8
VitaFit Cloud API Authentication Bypass via POST /front/login/sns/
VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to obtain a full session for a victim's account by submitting a linked Google or Facebook account identifier to the POST /front/login/sns/ endpoi…
-
Critical 9.2
GLPI: MFA bypass
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, during the login phase, an unauthenticated user could use a crafted URL to skip one-time-password verification, defeating two-factor authentication. This issue is fixed in vers…
-
Critical 9.6
VitaFit Cloud API Broken Access Control via S3 Token Endpoint
VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials by calling the POST /front/user/s3/token/ endpoint. Attackers can use these improperly scoped credential…
-
Critical 9.3
Readest: Unauthenticated SSRF / open request proxy in /api/opds/proxy
Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, the unauthenticated /api/opds/proxy route in apps/readest-app/src/app/api/opds/proxy/route.ts accepted an attacke…
-
Critical 9.1
GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover
GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 0.7.1 until 2.2.2, the /auth/saml/callback endpoint decoded SAML XML, used its NameID and attributes to resolve or provision a user, and minted a gpustack_…
-
Critical 9.8
GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin
GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in gpustack/api/auth.py treated a loopback request source as the built-in administrator when force_auth_localhost was false, wh…
KEV Nov 9, 2026 -
Critical 9.9
Yuxi sandbox isolation failure allows cross-tenant access and internal service compromise
Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. From 0.6.0.beta1 until 0.7.1, there is insufficient isolation between execution-capable Docker sandboxes and trusted application services. A low-privileged …
-
Critical 9.8
IBM Watson Speech Services Cartridge is vulnerable to a Use After Free condition in cryptography wheels OpenSSL
IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote attacker to execute arbitrary code due to a use-after-free vulnerability.
-
Critical 10.0
Comfast CF-WR632AX Multipart webmgnt path traversal
A vulnerability was detected in Comfast CF-WR632AX 2.6.0.1. Affected by this vulnerability is an unknown functionality of the file /usr/bin/webmgnt of the component Multipart Parser. Performing a manipulation of the argument filename results in path traversal…
-
Critical 9.8
vtenext 25.02 before 25.02.1 Unverified Password Change via hub/rpwd.php
vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to change any account password via hub/rpwd.php without token verification. Attackers knowing a valid user_name can send action=change_password …