40034 matches found
CVE-2026-55496 Cloudreve: Inactive/banned account emails leaked via GET /api/v4/user/search because SearchActive() omits the active-status predicate
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, GET /api/v4/user/search calls SearchActive without adding a StatusActive predicate and serializes matches at RedactLevelUser, allowing any logged-in user to enumerate email addresses and profile metadata for inactive ...
CVE-2026-55496
Cloudreve prior to version 4.17.0 exposes email addresses and basic profile metadata for inactive/banned accounts via GET /api/v4/user/search. The underlying bug is that SearchActive does not apply a StatusActive predicate, unlike GetActiveByID/GetActiveByDavAccount, so results include inactive/b...
EUVD-2026-51391
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, GET /api/v4/user/search calls SearchActive without adding a StatusActive predicate and serializes matches at RedactLevelUser, allowing any logged-in user to enumerate email addresses and profile metadata for inactive ...
CVE-2026-55496 Cloudreve: Inactive/banned account emails leaked via GET /api/v4/user/search because SearchActive() omits the active-status predicate
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, GET /api/v4/user/search calls SearchActive without adding a StatusActive predicate and serializes matches at RedactLevelUser, allowing any logged-in user to enumerate email addresses and profile metadata for inactive ...
SUSE CVE-2025-11776
Mattermost versions 11 fail to properly restrict access to archived channel search API which allows guest users to discover archived public channels via the /api/v4/teams/teamid/channels/searcharchived endpoint...
CVE-2026-14928: Exposure of Sensitive Information to an Unauthorized Actor
The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership checks before returning support-ticket content in a nonce-gated search handler, allowing any authenticated user Subscriber and above to read the subject and full message body of every other user's support...
Adobe Bridge < 15.1.7 / 16.x < 16.0.6 Multiple Vulnerabilities (APSB26-89)
The version of Adobe Bridge installed on the remote Windows host is prior to 15.1.7 or 16.0.6. It is, therefore, affected by multiple vulnerabilities as referenced in the apsb26-89 advisory. - Bridge is affected by an Untrusted Search Path vulnerability that could result in arbitrary code executi...
CVE-2026-55496: Exposure of Sensitive Information to an Unauthorized Actor
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, GET /api/v4/user/search calls SearchActive without adding a StatusActive predicate and serializes matches at RedactLevelUser, allowing any logged-in user to enumerate email addresses and profile metadata for inactive ...
Malicious Package
Overview mcp-search-server is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
LDAP Injection
Overview org.apache.zeppelin:zeppelin-server is a web-based notebook that enables interactive data analytics. You can make beautiful data-driven, interactive and collaborative documents with SQL, Scala and more. Affected versions of this package are vulnerable to LDAP Injection through the...
Malicious code in mcp-search-server (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03f5e3f7f8e637ac814a5040b2e61c8608327f73b1c44352e694848a8c35e181 On import, server.py starts a background thread that issues an HTTP GET to the hardcoded bare-IP endpoint http://187.127.73.142:8777 carrying a...
MAL-2026-11198 Malicious code in mcp-search-server (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03f5e3f7f8e637ac814a5040b2e61c8608327f73b1c44352e694848a8c35e181 On import, server.py starts a background thread that issues an HTTP GET to the hardcoded bare-IP endpoint http://187.127.73.142:8777 carrying a...
CVE-2026-13379
The Windows interactive service in OpenVPN 2.7alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during the disconnection process...
CVE-2026-13379
The Windows interactive service in OpenVPN 2.7alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during the disconnection process...
SUSE CVE-2026-44349
Daptin is a GraphQL/JSON-API headless CMS. Prior to version 0.11.5, processFuzzySearch in server/resource/resourcefindallpaginated.go:1484 splits the user-supplied column parameter by comma and interpolates each segment directly into goqu.Lfmt.Sprintf"LOWER%s LIKE ?", prefix+col raw SQL with no...
CVE-2026-13379
The Windows interactive service in OpenVPN 2.7alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during the disconnection process...
CVE-2026-13379
The Windows interactive service in OpenVPN 2.7alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during the disconnection process...
EUVD-2026-51233
The Windows interactive service in OpenVPN 2.7alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during the disconnection process...
CVE-2026-13379
The Windows interactive service in OpenVPN 2.7alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during the disconnection process...
CVE-2026-13379
CVE-2026-13379 affects the Windows interactive service component of OpenVPN, versions 2.7_alpha1 through 2.7.4. The vulnerability allows remote attackers to cause persistent DNS state pollution or a service crash by supplying a crafted search domain during the disconnection process. The connected...