Início / CVEs
Base de CVEs
Vulnerabilidades publicadas, com severidade, exploração conhecida e fontes oficiais.
CVE-2026-86485
Baixa · 3.3
CWE-291 07/09/2026
In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged…
In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks
CVE-2026-3690
Alta · 7.4
CWE-291 10/04/2026
OpenClaw Canvas Authentication Bypass Vulnerability
OpenClaw Canvas Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of OpenClaw. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the implementation of the the authentication function for canvas endpoints. The issue results from improper implementation of authentication. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-29311.
CVE-2025-66602
Crítica · 9.8
CWE-291 09/02/2026
Falha de dependência de endereço IP no servidor web do Yokogawa FAST/TOOLS
Foi identificada uma vulnerabilidade no FAST/TOOLS fornecido pela Yokogawa Electric Corporation. O servidor web aceita acesso por endereço IP. Quando um worm que procura aleatoriamente endereços IP invade a rede, ele poderia potencialmente ser atacado pelo worm. Os produtos e versões afetados são os seguintes: FAST/TOOLS (Pacotes: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 a R10.04
CVE-2025-59101
Alta · 7.7
CWE-291 26/01/2026
Insufficient Session Management in dormakaba access manager
Instead of typical session tokens or cookies, it is verified on a per-request basis if the originating IP address has once successfully logged in. As soon as an authentication request from a certain source IP is successful, the IP address is handled as authenticated. No other session information is stored. Therefore, it is possible to spoof the IP address of a logged-in user to gain access to the Access Manager web interface.