177192 matches found
CVE-2026-59890 vulnerabilities
Vulnerabilities for packages: py3-pipenv, pypy-3.10, httpie, airflow, datadog-agent, py3-setuptools, kubeflow-jupyter-web-app, kubeflow-katib, mlflow, kubeflow-volumes-web-app, superset...
CVE-2026-59885 vulnerabilities
Vulnerabilities for packages: mitmproxy, py3-cassandra-medusa, airflow, kubeflow-pipelines-visualization-server, datadog-agent, kubeflow-pipelines, kubeflow-jupyter-web-app, k8s-sidecar, mlflow, kubeflow-volumes-web-app, kserve, superset...
CVE-2026-54291 vulnerabilities
Vulnerabilities for packages: dependency-track, sonarqube, druid, thingsboard, apicurio-registry, flyway, keycloak...
GHSA-GG3M-VVP2-P2C5 vulnerabilities
Vulnerabilities for packages: kitty, terragrunt, ctop, vexctl, nsc, sftpgo-plugin-pubsub, external-dns, fuse-overlayfs-snapshotter, helm, kube-rbac-proxy, syft, kubernetes, sqlexporter, infinispan-operator, metrics-server, cluster-api-azure-controller, cloudnative-pg, runc,...
CVE-2026-46600 vulnerabilities
Vulnerabilities for packages: kitty, terragrunt, ctop, vexctl, nsc, sftpgo-plugin-pubsub, external-dns, fuse-overlayfs-snapshotter, helm, kube-rbac-proxy, syft, kubernetes, sqlexporter, infinispan-operator, metrics-server, cluster-api-azure-controller, cloudnative-pg, runc,...
CVE-2026-65913
DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USEPROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as...
CVE-2026-65901
DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in INPLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements,...
CVE-2026-65898
DOMPurify before 3.4.11 fails to clone the ALLOWEDATTR allowlist when setConfig is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements,...
postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind
A flaw was found in PostgreSQL. This vulnerability, related to symlink following in pgbasebackup plain format and pgrewind, allows an origin superuser to overwrite local files. By exploiting this, an attacker could potentially hijack the operating system account. This attack has practical...
Little CMS: lcms2: mm2/Little-CMS: Little CMS: Information disclosure or denial of service via integer overflow in CubeSize
A flaw was found in Little CMS. An integer overflow in the CubeSize function within cmslut.c occurs because the overflow check is performed after the multiplication. An attacker could exploit this vulnerability by providing a specially crafted input, potentially leading to information disclosure ...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in DeviceBoundSessionCredentials in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to bypass the same-origin policy through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
The use of after-free in CSS in Google Chrome before version 148.0.7778.96 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Integer overflow in the Extensions API in Google Chrome prior to version 150.0.7871.115 allowed an attacker who convinced a user to install a malicious extension to perform an out-of-bounds memory read through a crafted Chrome Extension. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in File Input in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...
Astra Linux – Vulnerability in Chromium
No description...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory via a crafted Chrome Extension. Chromium security severity: Low...
Astra Linux – Vulnerability in Chromium
Insufficient data validation in Animation in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass the same-origin policy through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
In V8, reading and writing outside the allowed boundaries before version 149.0.7827.103 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: High...