121561 matches found
CVE-2026-66083
The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain information about data sources they are not authorized to access. This may expose data source configuration and other sensitive metadata,...
CVE-2026-66083 Apache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasources/unauth-datasource
The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain information about data sources they are not authorized to access. This may expose data source configuration and other sensitive metadata,...
EUVD-2026-88742
The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain information about data sources they are not authorized to access. This may expose data source configuration and other sensitive metadata,...
CVE-2026-66083 Apache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasources/unauth-datasource
The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain information about data sources they are not authorized to access. This may expose data source configuration and other sensitive metadata,...
EUVD-2026-88609
A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/test of the component MCP Connector Integration. Such manipulation leads to command injection. It is possible to launch the attack remotely...
CVE-2026-102243
A command injection vulnerability exists in MODSetter SurfSense up to version 2.0.3 . The flaw resides in the MCP Connector Integration component, specifically involving unknown processing of the /api/search-source/connectors/mcp/test file. This vulnerability allows for remote attacks. While the ...
CLEANSTART-2026-VL04075 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...
CVE-2026-56854 affects multiple packages. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. See references for individual vulnerability...
EUVD-2026-88584
A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.11.0. The impacted element is the function dkimprocessset of the file dkim.c of the component Tag Tokenizer. Performing a manipulation results in use of less trusted source. The attack may be initiated remotely. The...
DEBIAN-CVE-2026-101277
A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.11.0. The impacted element is the function dkimprocessset of the file dkim.c of the component Tag Tokenizer. Performing a manipulation results in use of less trusted source. The attack may be initiated remotely. The...
CVE-2026-101277
A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.11.0. The impacted element is the function dkimprocessset of the file dkim.c of the component Tag Tokenizer. Performing a manipulation results in use of less trusted source. The attack may be initiated remotely. The...
UBUNTU-CVE-2026-101277
A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.11.0. The impacted element is the function dkimprocessset of the file dkim.c of the component Tag Tokenizer. Performing a manipulation results in use of less trusted source. The attack may be initiated remotely. The...
CVE-2026-102243: Improper Neutralization of Special Elements used in a Command
A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/test of the component MCP Connector Integration. Such manipulation leads to command injection. It is possible to launch the attack remotely...
Paused shared dashboard access tokens still expose data source configuration
Pausing a shared public dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credential...
PT-2026-102941
Name of the Vulnerable Software and Affected Versions Mediawiki - Collection extension versions prior to 1.46.1 Mediawiki - Collection extension version 1.45.5 Mediawiki - Collection extension version 1.43.10 Description An open redirect issue exists in the Mediawiki - Collection extension, which...
PT-2026-102671
Name of the Vulnerable Software and Affected Versions serialize-javascript versions 7.1.1 through 7.1.1 Description serialize-javascript converts JavaScript values into a JSON superset that includes functions and regular expressions. A flaw exists where function values are not fully protected...
Amazon Linux 2 : rclone (ALAS-2026-3947)
The version of rclone installed on the remote host is prior to 1.55.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3947 advisory. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the...
CVE-2026-100286: Exposure of Sensitive Information to an Unauthorized Actor
Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrative user to disclose integration secrets via a crafted API request...
PT-2026-102437
Name of the Vulnerable Software and Affected Versions MODSetter SurfSense versions prior to 2.0.4 Description An issue in the MCP Connector Integration component allows for remote command injection. This occurs due to improper processing of the /api/search-source/connectors/mcp/test endpoint...
CVE-2026-101277: Use of Less Trusted Source
A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.11.0. The impacted element is the function dkimprocessset of the file dkim.c of the component Tag Tokenizer. Performing a manipulation results in use of less trusted source. The attack may be initiated remotely. The...
CVE-2026-101277
A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.11.0. The impacted element is the function dkimprocessset of the file dkim.c of the component Tag Tokenizer. Performing a manipulation results in use of less trusted source. The attack may be initiated remotely. The...