515 matches found
CVE-2026-53454
Prior to version 2.5.2, Blueprint Studio configured Git's credential.helper store, writing usernames and access tokens in plaintext to a .git-credentials file accessible to other users/processes on the same filesystem, exposing Home Assistant Git credentials; the issue is fixed in 2.5.2. No explo...
CVE-2026-73365
Unauthenticated SQL Injection in JetAppointment = 2.5.2 versions...
EUVD-2026-60787
Unauthenticated SQL Injection in JetAppointment = 2.5.2 versions...
GHSA-G65V-27R3-5P6M guard-livereload has a directory traversal vulnerability
The vulnerability allows remote attackers to read arbitrary files on the server by exploiting improper path validation in the livereload server functionality. This vulnerability is related to the handling of file paths in the livereload server component, which could allow an attacker to traverse...
CLEANSTART-2026-TO01101 Security fixes in openbao-fips 2.5.2-r0
Package openbao-fips version 2.5.2-r0 fixes 16 vulnerabilities: CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32288...
BIT-OPENBAO-2026-33757 OpenBao lacks user confirmation for OIDC direct callback mode
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao does not prompt for user confirmation when logging in via JWT/OIDC and a role with callbackmode set to direct. This allows an attacker to start an authentication request and perform "remote phishin...
Fedora 44 : opam (2026-239dbbff34)
The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-239dbbff34 advisory. Version 2.5.2 of opam fixes CVE-2026-57825. See https://github.com/ocaml/opam/releases/tag/2.5.2 for more information. Tenable has extracted the preceding...
CVE-2026-49284
SimpleSAMLphp versions before 1.18.6 contain an information disclosure vulnerability. Prior to 2.4.7 and 2.5.2, SimpleSAMLphp's SAML SP ACS path does not enforce the IdP selected for an SP-initiated login when unsigned Response/InResponseTo is combined with a signed assertion lacking...
Security update for opam (important)
openSUSE Security Update: Security update for opam Announcement ID: openSUSE-SU-2026:0250-1 Rating: important References: Cross-References: CVE-2026-57825 Affected Products: openSUSE Backports SLE-15-SP7 An update that fixes one vulnerability is now available. Description: This update for opam...
OPENSUSE-SU-2026:11296-1 opam-2.5.2-1.2 on GA media
These are all security issues fixed in the opam-2.5.2-1.2 package on the GA media of openSUSE Tumbleweed...
CVE-2026-59954
CVE-2026-59954 affects Apollo ConfigService. Before version 2.5.2, when AccessKey or management key authentication is enabled, the service may authorize access to configuration data via non-canonical appId variants that downstream handling resolves to the protected app (including accent-variant a...
CVE-2026-59954 Apollo ConfigService access key authentication bypass via appId parsing and non-canonical matching
Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.2, Apollo ConfigService may allow unauthorized access to configuration data when AccessKey or management key authentication is enabled because ConfigService can accept a...
CVE-2026-59955 Apollo ConfigService access key authentication bypass via raw config file appId parsing
Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.2, Apollo ConfigService may allow unauthorized access to raw configuration data when AccessKey or management key authentication is enabled because requests under...
CVE-2026-59955
Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.2, Apollo ConfigService may allow unauthorized access to raw configuration data when AccessKey or management key authentication is enabled because requests under...
GHSA-H4PC-58CC-HC95 Apollo ConfigService access key authentication bypass via raw config file appId parsing
Summary Apollo ConfigService may allow unauthorized access to raw configuration data when AccessKey / management key authentication is enabled because authentication parsed the appId incorrectly for the raw config file endpoint. Details Requests under /configfiles/raw/appId/clusterName/namespace...
CVE-2026-9725 Printcart Web to Print Product Designer for WooCommerce <= 2.5.2 - Unauthenticated Arbitrary File Deletion
The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 2.5.2 This is due to insufficient path validation in the storedesigndata function, which constructs a filesystem path from the user-supplied...
PT-2026-55501
Name of the Vulnerable Software and Affected Versions Printcart Web to Print Product Designer for WooCommerce versions prior to 2.5.3 Description Insufficient path validation in the store design data function allows unauthenticated attackers to delete arbitrary files on the server. The issue occu...
PT-2026-53360
An issue in NASA AIT-Core v2.5.2 allows attackers to execute arbitrary code via a crafted packet...