86225 matches found
CVE-2026-12405
A flaw was found in rubygem-foremanremoteexecution. A command injection vulnerability exists in the Red Hat Satellite API /api/v2/jobinvocations. When a job template has the effectiveuser property marked as overridable: true, the application fails to properly sanitize the effectiveuser input...
EUVD-2026-90904
HCL BigFix Service Management is affected by an Information Disclosure vulnerability the application returns sensitive information in error messages when invalid inputs are sent to certain API endpoints . This information could enable an attacker to facilitate further attacks...
CVE-2026-67172
HCL BigFix Service Management is affected by an Information Disclosure vulnerability. The application returns sensitive information within error messages when invalid inputs are submitted to specific API endpoints . This exposure could potentially be used by an attacker to facilitate subsequent a...
CVE-2026-67172 HCL BigFix Service Management is affected by multiple security vulnerabilities.
HCL BigFix Service Management is affected by an Information Disclosure vulnerability the application returns sensitive information in error messages when invalid inputs are sent to certain API endpoints . This information could enable an attacker to facilitate further attacks...
CVE-2026-67172 HCL BigFix Service Management is affected by multiple security vulnerabilities.
HCL BigFix Service Management is affected by an Information Disclosure vulnerability the application returns sensitive information in error messages when invalid inputs are sent to certain API endpoints . This information could enable an attacker to facilitate further attacks...
CVE-2026-67171 HCL BigFix Service Management is affected by multiple security vulnerabilities.
HCL BigFix Service Management is affected by an Information Disclosure vulnerability because an exposed API endpoint exposes sensitive internal database information. This information could enable an attacker to facilitate targeted database attacks...
EUVD-2026-90903
HCL BigFix Service Management is affected by an Information Disclosure vulnerability because an exposed API endpoint exposes sensitive internal database information. This information could enable an attacker to facilitate targeted database attacks...
CVE-2026-67171 HCL BigFix Service Management is affected by multiple security vulnerabilities.
HCL BigFix Service Management is affected by an Information Disclosure vulnerability because an exposed API endpoint exposes sensitive internal database information. This information could enable an attacker to facilitate targeted database attacks...
CVE-2026-67171
HCL BigFix Service Management is impacted by an Information Disclosure vulnerability. The root cause is an exposed API endpoint that reveals sensitive internal database information, which could be leveraged by an attacker to facilitate targeted database attacks . No specific exploit details or re...
EUVD-2026-57811
SiYuan: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check...
GHSA-53FP-9JMV-227G SiYuan: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check
Summary /api/storage/getOutlineStorage is registered with CheckAuth only and performs no authorization of any kind. Given a document identifier it returns that document's stored outline state, regardless of the document's publish tier. The two write endpoints for the same data, setOutlineStorage...
JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)
Description A language pack ships a Plural-Forms header saying how the language counts, for example nplurals=2; plural=n != 1;. JupyterLab turns that string into a function with new Function, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was...
GHSA-3JQQ-PW4J-PQCJ JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)
Description A language pack ships a Plural-Forms header saying how the language counts, for example nplurals=2; plural=n != 1;. JupyterLab turns that string into a function with new Function, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was...
EUVD-2026-89459
JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs...
JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard
Description JupyterLab 4.5.0 enabled copying and pasing cells through the system clipboard. The paste path parses clipboard text as cell JSON and inserts the cells without clearing metadata.trusted, so a payload can declare its own output as trusted. JupyterLab does not sanitize a trusted output...
GHSA-6966-VJJ6-99XV JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard
Description JupyterLab 4.5.0 enabled copying and pasing cells through the system clipboard. The paste path parses clipboard text as cell JSON and inserts the cells without clearing metadata.trusted, so a payload can declare its own output as trusted. JupyterLab does not sanitize a trusted output...
CVE-2026-67104
HCL BigFix Service Management is affected by an Information Disclosure vulnerability, which could allow an unauthenticated attacker to analyze publicly accessible JavaScript files, enabling the discovery of hidden administrative API endpoints for further targeted exploitation...
CVE-2026-67106
HCL BigFix Service Management is affected by an Information Disclosure vulnerability because two exposed API endpoints return sensitive data. This information could enable an attacker to launch further, more serious attacks...
CVE-2026-79898
Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI REST or SOAP API, or the cacrl command-line interface could cause shell command substitution to be processed by crlserver as root on the BoKS Master...