265777 matches found
EUVD-2026-54517
Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creating or updating a scheduled task through the administrative UI. An account holding permission to create at least one scheduled task type could supply a crafted property val...
GHSA-HMQ2-W58F-27JC GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython
Summary GitPython computes the on-disk location of a submodule's separate Git directory .git/modules/ from the submodule's .gitmodules section name with no validation. Because that name is fully attacker-controlled content of a cloned repository, a malicious repository can set a submodule name to...
EUVD-2026-54500
Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, a field-level permissions bypass exposes restricted DocType fields. This issue is fixed in versions 16.23.0 and 15.112.0...
CVE-2026-62996 Smarty Security stream restriction bypass through stream: resource
Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. From 5.0.0 until 5.8.4, Smarty's stream: resource-name handling does not adequately restrict which PHP stream wrappers and filter chains can be referenced from a template, allowing a...
CVE-2026-19264
creationtimestamp| type| source ---|---|--- 2026-08-07 15:02:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msit6t2ljn26 2026-08-07 16:20:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/675k6a4kh2ptu 2026-08-12 08:00:05+00:00| seen|...
CVE-2026-52021
creationtimestamp| type| source ---|---|--- 2026-08-07 14:32:36+00:00| seen| https://gist.github.com/itsmohitnarayan/e456399f083130962bab6c710f208437...
SUSE-SU-2026:3527-1 Security update for gstreamer-plugins-bad
This update for gstreamer-plugins-bad fixes the following issue: - CVE-2026-52718: byte count instead of a bit count in gstav1parserparsetilelistobu can cause parser desynchronization and an application crash bsc1268394...
UBUNTU-CVE-2026-61477
An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the...
CVE-2026-65667
creationtimestamp| type| source ---|---|--- 2026-08-07 14:14:20+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117054639846574727 2026-08-11 19:00:48+00:00| seen| https://www.thezdi.com/blog/2026/8/11/the-august-2026-security-update-review 2026-08-11 22:01:15+00:00| seen|...
JLSEC-2026-1181 FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect...
FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vfswaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filterframe function reuses a temporary row buffer sized for plane 0's...
CVE-2026-50623
A flaw was found in Apache CXF. An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService. Due to a missing 'throw' keyword in the security context check, an unauthenticated network attacker can access the introspection endpoint. This could lead to unauthorized access ...
CVE-2026-7406
creationtimestamp| type| source ---|---|--- 2026-08-07 12:45:04+00:00| seen| https://www.acn.gov.it/portale/w/aggiornamenti-per-prodotti-autodesk-11...
RLSA-2026:51153 Important: gpsd-minimal security update
gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. The Rocky Enterprise Software Foundation support fo...
Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update
An update for kernel is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
CVE-2025-30374
creationtimestamp| type| source ---|---|--- 2026-08-07 10:17:15+00:00| seen| Telegram/zAJ5TWBIUoS-Z2Q79eIMtdFrdAnvwlKVqfHngA-3uEfDl5Y 2026-08-08 00:08:31+00:00| published-proof-of-concept| Telegram/zAJ5TWBIUoS-Z2Q79eIMtdFrdAnvwlKVqfHngA-3uEfDl5Y...
CVE-2026-12261
creationtimestamp| type| source ---|---|--- 2026-08-07 08:31:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/h7abmppp3qpxc...
GHSA-QRQ2-C54W-WGQM vulnerabilities
Vulnerabilities for packages: nodejs...
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**.
...
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
...