Published 2026-10-08 by brocade

Published 2026-10-08 by brocade

Published 2026-10-08 by brocade

Potential brute force vulnerability due to non-expiring SMS OTPs

Published 2026-10-08 by WSO2

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification

Published 2026-10-07 by Wordfence

Aurora Heatmap <= 1.7.2 - Unauthenticated Stored Cross-Site Scripting via 'url' Parameter

Published 2026-10-07 by Wordfence

pgjdbc pads a value shorter than its declared length with bytes of earlier statements (rather than zeros)

Published 2026-10-07 by PostgreSQL

pgjdbc does not enforce requireAuth when the value excludes every authentication method

Published 2026-10-07 by PostgreSQL

Vault ACL Policy Evaluation May Allow Bypass of Deny Restrictions

Published 2026-10-07 by HashiCorp

Vault ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution

Published 2026-10-07 by HashiCorp

Vault Vulnerable to Arbitrary Code Execution via Plugin Catalog Entries Restored From Raft Snapshots

Published 2026-10-07 by HashiCorp

AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel

Published 2026-10-07 by GitHub_M

AsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept check

Published 2026-10-07 by GitHub_M

AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source

Published 2026-10-07 by GitHub_M

AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host

Published 2026-10-07 by GitHub_M

Vault PKI ACME Issues Certificate With Unvalidated SANs

Published 2026-10-07 by HashiCorp

AsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identities

Published 2026-10-07 by GitHub_M

AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk

Published 2026-10-07 by GitHub_M

AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int

Published 2026-10-07 by GitHub_M

AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT

Published 2026-10-07 by GitHub_M

AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext

Published 2026-10-07 by GitHub_M

AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins

Published 2026-10-07 by GitHub_M

AsyncHttpClient: Incomplete origin checks in the default cookie store allow cookie tossing onto public-suffix and IP-address hosts

Published 2026-10-07 by GitHub_M

AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)

Published 2026-10-07 by GitHub_M

AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled

Published 2026-10-07 by GitHub_M

Server-Side Request Forgery (SSRF) through Custom API Tools in Splunk MCP Server

Published 2026-10-07 by cisco

Improper Adherence to Coding Standards in Splunk Enterprise

Published 2026-10-07 by cisco

Improper Neutralization in Splunk Enterprise

Published 2026-10-07 by cisco

Protection Mechanism Failure in Splunk Enterprise

Published 2026-10-07 by cisco

Improper Control of a Resource Through its Lifetime in Splunk Enterprise

Published 2026-10-07 by cisco

Improper Access Control in Splunk Enterprise

Published 2026-10-07 by cisco

Incorrect Permission Assignment for App Key Value Store Collections in Splunk Secure Gateway

Published 2026-10-07 by cisco

Improper Input Validation of Index Names through the collect Command in Splunk Enterprise

Published 2026-10-07 by cisco

Authorization Bypass in SPL2 Module Permissions in Splunk Enterprise

Published 2026-10-07 by cisco

Improper Input Validation of Native Splunk Usernames through the REST API in Splunk Enterprise

Published 2026-10-07 by cisco

Information Disclosure in the Discover Splunk Observability Cloud app through Splunk Web for Splunk Enterprise

Published 2026-10-07 by cisco

Improper Authorization in Search Job Listings through the REST API in Splunk Enterprise

Published 2026-10-07 by cisco

Server-Side Request Forgery (SSRF) through the REST API in Splunk App for Splunk Observability Cloud

Published 2026-10-07 by cisco

Improper Input Validation through the collect Command in Splunk Enterprise

Published 2026-10-07 by cisco

Missing Access Control through the REST API in Splunk Secure Gateway

Published 2026-10-07 by cisco