| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-124021 | 8.1 | Control Web Panel (CWP) before webpanel_version 1.30.6 contains an authorization bypass vulnerability in the validate() function of api/v1/index.php that allows attackers holding a password-recovery token and a predictable legacy signature to obtain | 2026-11-13 22:17:22 | 2026-11-13 22:17:22 |
| CVE-2026-124020 | 8.1 | Control Web Panel (CWP) before webpanel_version 1.30.6 contains a host header injection vulnerability that allows unauthenticated attackers to manipulate the password-recovery reset URL by injecting the HTTP Host header into the /v1/lostpass/ route's | 2026-11-13 22:17:22 | 2026-11-13 22:17:22 |
| CVE-2026-123628 | 7.5 | IBM webMethods Integration Server 10.15 and 11.1 could allow a remote attacker to obtain sensitive information due to an exposure of sensitive server-side environment variables and Java runtime details. | 2026-11-13 22:17:22 | 2026-11-13 22:17:21 |
| CVE-2026-127216 | 6.5 | Injection Guard plugin for WordPress before 1.4.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to trigger password hash export by tricking a logged-in administrator into loading a crafted link, since the i | 2026-11-13 22:17:22 | 2026-11-13 21:17:43 |
| CVE-2026-127213 | 6.5 | LearnPress Course Wishlist Add-on before 4.1.2 contains an insecure direct object reference vulnerability that allows remote attackers to manipulate any user's course wishlist by supplying an arbitrary user_id parameter to the render_button callback | 2026-11-13 22:17:22 | 2026-11-13 20:18:55 |
| CVE-2026-128087 | 3.7 | russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From version 0.55.0 until version 0.65.1, the initial key exchange invokes client::Handler::kex_done() with the raw shared secret before check_server_ke | 2026-11-13 22:17:22 | 2026-11-13 19:19:31 |
| CVE-2026-128082 | 7.5 | AutoMapper is a convention-based object-object mapper in .NET. Prior to 15.1.4 and from 16.0.0 until 16.3.0, AutoMapper increments type depth only after creating the destination, so recursive mapping performed through constructor parameters occurs be | 2026-11-13 22:17:22 | 2026-11-13 19:19:30 |
| CVE-2026-128075 | 5.3 | Nuxt is an open-source web development framework for Vue.js. From 3.0.0 until 4.6.4, Nuxt wraps non-HTTP errors thrown during server rendering with createError and incorrectly treats the result as an error deliberately exposed by the application. In | 2026-11-13 22:17:22 | 2026-11-13 18:17:36 |
| CVE-2026-127916 | 2.9 | bootutil_img_hash() computes the image digest over ih_hdr_size + ih_img_size + ih_protect_tlv_size bytes, all three taken from the candidate image's header, and reads that span out of the slot without checking that it fits in the flash area. The thre | 2026-11-13 22:17:22 | 2026-11-13 02:18:55 |
| CVE-2026-115788 | 8.1 | IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands is vulnerable to Log Forging on a request to create a resource. | 2026-11-13 22:17:21 | 2026-11-13 22:17:21 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/40249
Zapisa po stranici: