PULSEUnderground Intel

EN VIVO25señales / 24h

FEED

ransomvexy ransomware reclama a ZipAI · VN · Technologyransomsilentransomgroup reclama a Smith, Gambrell & Russell, LLP · US · Professional Servicesransomsilentransomgroup reclama a W... R...ransomqilin reclama a Insurance Audit Services · US · Financial Servicesransomn0n reclama a Company #137 · CAransomn0n reclama a Company #136 · DKransomn0n reclama a Company #135 · IDransomn0n reclama a Company #134 · USransomn0n reclama a Company #133 · USransomredact reclama a Omni Hotels & Resorts · US · Hospitalityransomakira reclama a Westboro Partnersransomakira reclama a System Plus · Technologyransomakira reclama a David L Wade & Associates · Professional Servicesransomakira reclama a Source Energy Services · CA · Energy & Utilitiesransomvexy ransomware reclama a ZipAI · VN · Technologyransomsilentransomgroup reclama a Smith, Gambrell & Russell, LLP · US · Professional Servicesransomsilentransomgroup reclama a W... R...ransomqilin reclama a Insurance Audit Services · US · Financial Servicesransomn0n reclama a Company #137 · CAransomn0n reclama a Company #136 · DKransomn0n reclama a Company #135 · IDransomn0n reclama a Company #134 · USransomn0n reclama a Company #133 · USransomredact reclama a Omni Hotels & Resorts · US · Hospitalityransomakira reclama a Westboro Partnersransomakira reclama a System Plus · Technologyransomakira reclama a David L Wade & Associates · Professional Servicesransomakira reclama a Source Energy Services · CA · Energy & Utilities

← Todos los CVEs

CVE Watch5 nov 2026

CVE-2026-73578

Missing authorization enforcement in RequestHandler.renderView in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauth

CVSS

—

Sin CVSS

EPSS

—

KEV

—

Exploit Today

0

0-100

Publicado: 5 nov 2026 · Última mod.: 5 nov 2026 · CWE-288

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

Missing authorization enforcement in RequestHandler.renderView in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the request-map authentication policy for protected views by supplying a crafted _LAST_VIEW_NAME_ value, which is stored as saved-view state in the anonymous session and later rendered without re-applying the original view's authentication requirement, potentially exposing protected views and associated business data. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Referencias oficiales

lists.apache.orghttps://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-493938.4 ALT

——0OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.56.0, the core server protects HTTP POST requests to /rpc with bearer middleware but exposes Socket.IO rpc:request and chat:start handlers without equivalent transport or handler-level authentication. A local unauthenticated client can connect to the Socket.IO namespace and dispatch requests through the same protected controller path that rejects a missing bearer on /rpc. Depending on the selected method, the attacker can read configuration or health data, start agent flows, interact with integrated account APIs, alter local data, or stop and restart services. This issue is fixed in version 0.56.0.11h CVE-2026-73577—

——0Incorrect authorization in RequestHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the authentication requirement of a protected view by appending it as a path suffix to a public request (e.g., /catalog/control/ListLocales/showPortalPage), causing the servlet to authorize the request based on the public path component while rendering the protected suffix view. Users are recommended to upgrade to version 24.09.08, which fixes this issue.13h CVE-2026-52848—

——9GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, during the login phase, an unauthenticated user could use a crafted URL to skip one-time-password verification, defeating two-factor authentication. This issue is fixed in version 11.0.8.1d CVE-2026-1042037.5 ALT

——17Traccar is an open source GPS tracking system. From 5.1 until 6.15.0, WebModule.java's MediaFilter Guice mapping and WebServer.java's Jetty ResourceServlet assign different routing meanings to path parameters at /api/media/*. An unauthenticated attacker who knows or guesses a device unique ID and media filename can insert a semicolon at the Servlet boundary, bypass MediaFilter's session and device authorization checks, and retrieve the protected media because Jetty still dispatches the noncanonical path to ResourceServlet. The demonstrated impact is read-only disclosure of a protected device media file; depending on the deployment and stored media, this could expose photographs, audio, video, or other uploaded files. The advisory does not establish directory listing, traversal, modification, account takeover, denial of service, or code execution. Reverse proxies that reject or rewrite semicolon path parameters may block the request. This issue is fixed in version 6.15.0.1d CVE-2026-577755.3 MED

——5Authentication Bypass Using an Alternate Path or Channel vulnerability in RelyWP Simple Cloudflare Turnstile simple-cloudflare-turnstile allows Authentication Abuse.This issue affects Simple Cloudflare Turnstile: from n/a through 1.44.1.1d CVE-2026-22060—

——6All versions of StorageGRID (formerly StorageGRID Webscale) in default & common configurations allow an unauthenticated attacker to access a limited set of APIs that are intended for use within the grid.12h