Tag: default-config

All items tagged default-config.

• CVE-2026-20896 — Gitea (Docker): trust-all reverse-proxy default lets an unauthenticated attacker impersonate any user via `X-WEBAUTH-USER`
  in 2026-06-23
• CVE-2026-52806 — Gogs self-hosted Git server: argument injection to OS command execution (BSI critical batch)
  in 2026-06-20
• CVE-2026-20253 — Splunk Enterprise: unauthenticated pre-auth RCE via the PostgreSQL sidecar proxy
  in 2026-06-14
• CERT-PL discloses hardcoded-credential supply-chain flaw in KS-SOMED healthcare software (CVE-2026-42251)
  in 2026-06-02
• CVE-2026-44825 — Apache Solr: unauthenticated admin via hardcoded template credentials, no patch yet
  in 2026-06-02
• CVE-2026-35087 / CVE-2026-35089 / CVE-2026-35090 — Slican PBX telephony exchanges, triple pre-authentication admin bypass (CERT Polska)
  in 2026-05-28
• BSI flags Netgate pfSense Community Edition as critical-unpatched — CVE-2025-69690 / CVE-2025-69691 authenticated root RCE, vendor refuses to fix
  in 2026-05-11