1249 matches found
OpenMetaData - SpEL Injection in PUT /api/v1/policies
OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. CompiledRule::validateExpression is also called from PolicyRepository.prepare. prepare is called from...
New-lib3mf.dll-for-MeshMixer
Nueva lib3mf.dll para MeshMixer lib3mf.dll precompilada para MeshMixer que incluye un parche retroportado para CVE-2021-21772 y una actualización de zlib 1.3.1. Reemplaza el archivo original en C:\Program Files\Autodesk\Meshmixer\ Código fuente incluido, si deseas compilarlo tú mismo...
CLEANSTART-2026-JI50806 Security fix for CVE-2025-47281 applied in: kyverno-policy-reporter-kyverno-plugin-fips 1.3.1-r9
Security vulnerability affects the kyverno-policy-reporter-kyverno-plugin-fips package. This issue is resolved in later releases. See references for vulnerability details...
CVE-2026-81769
Incorrect Privilege Assignment vulnerability in LiquidThemes Booking Hub allows Privilege Escalation. This issue affects Booking Hub: from n/a through 1.3.1...
EUVD-2026-69927
Incorrect Privilege Assignment vulnerability in LiquidThemes Booking Hub allows Privilege Escalation. This issue affects Booking Hub: from n/a through 1.3.1...
PT-2026-84688
Name of the Vulnerable Software and Affected Versions Booking Hub versions prior to 1.3.2 Description An incorrect privilege assignment issue allows users with Subscriber roles to perform privilege escalation. Recommendations Update to a version newer than 1.3.1...
EUVD-2026-63576
SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. Prior to version 1.3.1, a malicious SecureDrop Server could bypass securedrop-proxy's origin limitation by responding with cross-origin redirects. SecureDr...
PT-2026-79114
SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. Prior to version 1.3.1, a malicious SecureDrop Server could bypass securedrop-proxy's origin limitation by responding with cross-origin redirects. SecureDr...
EUVD-2026-53990
Unauthenticated PHP Object Injection in A.Williams = 1.3.1 versions...
CVE-2026-65572
The CVE-2026-65572 entry concerns the WordPress A.Williams theme (versions
CVE-2026-65572 WordPress A.Williams theme <= 1.3.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in A.Williams = 1.3.1 versions...
CVE-2026-65572 WordPress A.Williams theme <= 1.3.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in A.Williams = 1.3.1 versions...
WordPress A.Williams theme <= 1.3.1 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Bonds in WordPress Theme A.Williams versions = 1.3.1...
WordPress WP Real IP-based Access Control plugin <= 1.3.1 - Unauthenticated Stored XSS vulnerability
Unauthenticated Stored XSS vulnerability discovered by Abaid Ur Rehman in WordPress Plugin WP Real IP-based Access Control versions = 1.3.1...
CVE-2026-48121
@langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0 and below are vulnerable to NoSQL injection: checkpoint identifiers threadid, checkpointns, checkpointid from config.configurable are passed into MongoDB fi...
CVE-2026-48121 @langchain/langgraph-checkpoint-mongodb: NoSQL parameter injection in MongoDBSaver allows cross-tenant state access
@langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0 and below are vulnerable to NoSQL injection: checkpoint identifiers threadid, checkpointns, checkpointid from config.configurable are passed into MongoDB fi...
CVE-2026-48121 @langchain/langgraph-checkpoint-mongodb: NoSQL parameter injection in MongoDBSaver allows cross-tenant state access
@langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0 and below are vulnerable to NoSQL injection: checkpoint identifiers threadid, checkpointns, checkpointid from config.configurable are passed into MongoDB fi...
CVE-2026-48121
The CVE-2026-48121 vulnerability affects @langchain/langgraph-checkpoint-mongodb (MongoDBSaver) and involves NoSQL parameter injection in MongoDB queries. Versions 1.3.0 and earlier pass checkpoint identifiers (thread_id, checkpoint_ns, checkpoint_id) from config.configurable directly into MongoD...