490134 matches found
CVE-2026-82468
Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cross-origin form posts with content types containing application/json substrings to bypass CSRF token validation and force victims to...
MINI-FH3W-G93W-4V7F
Bulletin has no description...
Tor: Multiple Vulnerabilities
Background Tor is an implementation of second generation Onion Routing, a connection-oriented anonymizing communication service. Description Multiple vulnerabilities have been discovered in Tor. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CV...
EUVD-2026-42985
Snipe-IT has an Improper Privilege Management issue...
Malicious code in grafeno-actions (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3a52df88a9094028961676cb72f9e43f88fcef959cc4e1db63687785058c2d7d The OpenSSF Package Analysis project identified 'grafeno-actions' @ 999.0.0 npm as malicious. It is considered malicious because: - The package...
CVE-2026-17203
IBM Administration Runtime Expert for i 1R1M0 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication enforcement...
EUVD-2026-42286
SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets...
CVE-2026-3686 Vulnerabilities exists in IBM Cloud Pak for Data System
IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 is vulnerable to a denial of service due to improper limitation of resources...
CVE-2026-3686
IBM Cloud Pak for Data System versions 11.3.0.2 through Interim Fix 001 are vulnerable to a denial of service caused by improper limitation of resources . The CVSS v3.1 base score is 6.2 (MEDIUM) with a local attack vector, no privileges required, and high availability impact but no confidentiali...
EUVD-2026-42297
Portainer has Unauthenticated Restore Endpoint that Allows Admin Takeover on Uninitialized Instances...
@alancode95/core-prisma (1.0.0), @aliceo2/infologger (>=1.15.0, <=1.15.1) +39 more potentially affected by CVE-2026-55215 via mariadb (>=3.4.0, <=3.4.5)
mariadb NPM version =3.4.0, =1.15.0, =1.0.0, =0.3.3, =0.4.0, =0.5.0-beta.7, =2.105.0, =1.0.0, =6.3.14-dev.35, =0.2.1, =6.11.0-dev.20, =1.2.1, =2.1.0, =0.61.0, =0.93.0, =0.112.0 and more Source cves: CVE-2026-55215 Source advisory: OSV:GHSA-CQHC-2H57-WPXF...
EUVD-2026-44949
Buffa has a Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref...
EUVD-2026-42984
Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update...
EUVD-2026-42986
Snipe-IT has missing object-level authorization in Kits API...
EUVD-2026-42989
Snipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded cancelbyadmin Parameter...
EUVD-2026-42983
Snipe-IT vulnerable to directory traversal in displaySig...
SUSE CVE-2026-80641
In the Linux kernel, the following vulnerability has been resolved: wifi: wlcore: enable the right set of ciphers The firmware version number check for IGTK introduced in commit c34dbc5900b0 "wifi: wlcore: Add support for IGTK key" lets the amount of ciphers decrease on every boot of a too old...
CVE-2026-55569 aqua: Archive extraction in aqua follows attacker-planted symlinks, allowing writes outside the install directory
aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.FileInfo.LinkTarget without verifying that the target remains under the extraction destination. A later regular-file entry a...