| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-109359 | 7.7 | Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to confirm the serving peer uses the same manifest generation. Attackers with write access to manifest history can replay a supersede | 2026-10-12 17:17:33 | 2026-10-12 17:17:33 |
| CVE-2026-109358 | 7.8 | Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer writes the containerd config world-writable (0666). Local unprivileged users on the node can modify the containerd config, for exam | 2026-10-12 17:17:33 | 2026-10-12 17:17:33 |
| CVE-2026-109357 | 8.1 | LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and authentication only checks user existence. When REMOTE_USER is not forward | 2026-10-12 17:17:33 | 2026-10-12 17:17:33 |
| CVE-2026-109356 | 4.3 | LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that allows global-read users to physically delete ports without delete privileges. Attackers with read-only accounts can send DELETE requests to /ports/p | 2026-10-12 17:17:32 | 2026-10-12 17:17:32 |
| CVE-2026-109355 | 6.1 | LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in get_oxidized_nodes_list() that renders Oxidized API fields and SNMP sysName unescaped. Attackers controlling the Oxidized response or a device's SNMP sysName can inject sc | 2026-10-12 17:17:32 | 2026-10-12 17:17:32 |
| CVE-2026-109354 | 4.3 | LibreNMS before 26.9.0 contains a path traversal vulnerability in nfsen_channel_common.inc.php that allows authenticated users to read unauthorized RRD data by injecting ../ sequences into the channel parameter. Attackers with access to one NFSen-ena | 2026-10-12 17:17:32 | 2026-10-12 17:17:32 |
| CVE-2026-109353 | 7.1 | LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notification_id parameter to notifications.inc.php. Attackers can perform cross-table reads of users.password has | 2026-10-12 17:17:32 | 2026-10-12 17:17:32 |
| CVE-2026-109352 | 6.1 | LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in includes/html/pages/device/wireless.inc.php, which echoes wireless sensor sensor_descr values, populated from SNMP DisplayString fields during discovery, into HTML without | 2026-10-12 17:17:32 | 2026-10-12 17:17:32 |
| CVE-2026-109351 | 6.5 | Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count. Malicious remotes can serve a 12-byte pack header claiming 0xFFFF | 2026-10-12 17:17:32 | 2026-10-12 17:17:32 |
| CVE-2026-109350 | 6.5 | Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFS_DELTA entries. Attackers can serve a thin pack with a REF_DELTA referencing an existin | 2026-10-12 17:17:31 | 2026-10-12 17:17:31 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/39518
Zapisa po stranici: