13197 matches found
Capsule security vulnerabilities
Capsule is an open-source Kubernetes framework developed by Project Capsule. Versions prior to Capsule 0.13.0 have security vulnerabilities. These vulnerabilities stem from the processing of TenantResource RawItems, which does not set namespaces for cluster-wide resources. This could allow tenant...
CVE-2026-40990: Allocation of Resources Without Limits or Throttling
OOM error is possible while attempting to add infinite amount of functions to Function Registry. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6...
PT-2026-45399
Name of the Vulnerable Software and Affected Versions Apache Fesod Incubating fesod-sheet versions prior to 2.0.2-incubating Description Server-Side Request Forgery SSRF in the UrlImageConverter component allows attackers to trigger outbound network requests to internal or restricted resources by...
Missing Authorization
Drupal Authenticator Login is vulnerable to Missing Authorization. The vulnerability is due to improper authorization checks in the Authenticator Login component, which allows an attacker to perform forceful browsing and access restricted functionality or resources without proper authorization...
Improper Privilege Management
Capsule is vulnerable to Improper Privilege Management. The vulnerability is due to improper handling of cluster-scoped resources in the TenantResource RawItems processing logic, which allows a tenant administrator to exploit the Capsule Controller's cluster-admin privileges to create unauthorize...
Exposure of Sensitive System Information to an Unauthorized Control Sphere
Overview PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent...
Server-side Request Forgery (SSRF)
Overview phanan/koel is a personal audio streaming service. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the processing of unvalidated enclosure URLs in podcast episode feeds. An attacker can access sensitive internal resources and exfiltrate data by...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization in the handling of cross-namespace references in resource management. An attacker can gain unauthorized access to secrets, templates, or host resources in other namespaces by creating or modifying resources with...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization in the handling of cross-namespace references in resource management. An attacker can gain unauthorized access to secrets, templates, or host resources in other namespaces by creating or modifying resources with...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization in the controller process. An attacker can cause unauthorized modification of user-owned resources by referencing user-provided Secrets or ConfigMaps in deployments. Remediation Upgrade...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization in the controller process. An attacker can cause unauthorized modification of user-owned resources by referencing user-provided Secrets or ConfigMaps in deployments. Remediation Upgrade...
Improper Control of Dynamically-Managed Code Resources
Overview org.webjars.npm:vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Improper Control of Dynamically-Managed Code Resources through the WebAssembly.promising and WebAssembly.Suspending JSPI APIs in...
Improper Control of Dynamically-Managed Code Resources
Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Improper Control of Dynamically-Managed Code Resources through the NodeVM constructor in lib/nodevm.js. An attacker can obtain host code execution by...
Improper Control of Dynamically-Managed Code Resources
Overview org.webjars.npm:vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Improper Control of Dynamically-Managed Code Resources via the localPromise constructor in lib/setup-sandbox.js. An attacker can obta...
Improper Control of Dynamically-Managed Code Resources
Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Improper Control of Dynamically-Managed Code Resources via the localPromise constructor in lib/setup-sandbox.js. An attacker can obtain a host-realm...
Improper Control of Dynamically-Managed Code Resources
Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Improper Control of Dynamically-Managed Code Resources through the lib/bridge.js apply trap and thisEnsureThis proto-walk. An attacker can obtain hos...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the IsPublicIP function. An attacker can access internal network resources and potentially exfiltrate sensitive information by crafting a DNS AAAA record that resolves to specific IPv6 prefixes, which...
CVE-2026-10107
MoviePilot v2 is affected by an SSRF flaw in the image proxy endpoint /api/v1/system/img/{proxy}. Authentication is required, and an attacker can supply a resource_token cookie and a URL whose domain matches the allowlist to fetch arbitrary URLs. The root cause is that Safe URL checking (Security...
CVE-2026-10107
MoviePilot v2 contains a server-side request forgery vulnerability in the image proxy endpoint that allows authenticated attackers to request arbitrary URLs by supplying a resourcetoken cookie and a URL whose domain matches the assembled allowlist. Attackers can bypass internal network protection...
CVE-2026-9808
An authorization bypass vulnerability exists in the Mautic 7 API v2 endpoints utilizing API Platform. Under certain conditions, roles configured with owner-scope restrictions such as "viewown" or "editown" are not properly enforced. This allows low-privilege authenticated API users to bypass...