261990 matches found
Уязвимость функции readSeparateStripsIntoBuffer() библиотеки LibTIFF, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
Уязвимость функции readSeparateStripsIntoBuffer библиотеки LibTIFF связана с выходом операции за границы буфера в памяти. Эксплуатация уязвимости может позволить нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации посредством специально созданных...
The vulnerability of the Cisco RoomOS operating system, related to the lack of measures for data encryption, allows a intruder to disclose protected information.
The vulnerability of the Cisco RoomOS operating system is related to the lack of measures for data encryption. Exploiting this vulnerability can allow a malicious actor to disclose the protected information remotely...
Oracle Linux 10 : python3.14 (ELSA-2026-28581)
The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-28581 advisory. 3.14.5-1 - Update to 3.14.5 Resolves: RHEL-176147 3.14.5rc1-1 - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage...
UBUNTU-CVE-2026-62321
Unknown description...
PT-2026-60838
Agentic-Flow is an AI agent orchestration platform. Prior to 2.0.14, agentic-flow MCP server tools in src/mcp/standalone-stdio.ts, src/mcp/fastmcp/servers/claude-flow-sdk.ts, src/mcp/fastmcp/servers/stdio-full.ts, src/mcp/fastmcp/servers/http-streaming-updated.ts,...
CVE-2026-14253
creationtimestamp| type| source ---|---|--- 2026-07-16 23:41:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsfxkt7h72u...
CVE-2026-54340
CVE-2026-54340 affects the h2o HTTP server (HTTP/2) and describes an HTTP/2 state amplification issue where HPACK decompression amplification combines with Slowloris-style stream stalling. Amplified decoded header state can be retained by stalled HTTP/2 streams; depending on configuration, additi...
CVE-2026-43978
wger is a free, open-source workout and fitness manager. In versions prior to 2.6, a gym trainer can escalate their session to any higher-privileged account gym manager, general manager by chaining two calls to the trainer-login endpoint. Once a trainer performs a legitimate switch into a...
CVE-2026-44182
Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. In versions prior to 3.3.0, the server interpolates untrusted environment variables e.g., KERNELXXX into Kubernetes manifests without YAML-aware escapin...
CVE-2026-58598
Technical details are not publicly available in the provided documents. Monitor for updates from vendors and advisories for CVE-2026-58598.
CVE-2026-45334 Kirby: Content locks disclose IDs and emails of inaccessible users from `users.access/list` permissions
Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the content-locking feature returned lock information without checking the requesting user's access permissions. Kirby's Panel includes a content-locking feature that records which user currently has a model...
CVE-2026-44176 Kirby: `pages.access` permission is not checked during rendering of page drafts
Kirby is an open-source content management system. Versions prior to 4.9.1 and 5.4.1 do not check the pages.access permission during page draft rendering. Permissions are defined for each user role in the user blueprint site/blueprints/users/.... It is also possible to customize the permissions f...
CVE-2026-15422
creationtimestamp| type| source ---|---|--- 2026-07-16 20:52:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqs4ig6jmt2a 2026-07-16 22:49:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsczijzrb2c...
CVE-2026-54526
creationtimestamp| type| source ---|---|--- 2026-07-16 20:45:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqs457pjpd2l 2026-08-13 16:35:09+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-48p8-g2fx-3wwm 2026-08-13 17:32:46+00:00| seen|...
CVE-2023-24816 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines-visualization-server...
GHSA-36FQ-JGMW-4R9C vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines-visualization-server...
CVE-2026-55629
Whistle is an HTTP, HTTP2, HTTPS, and WebSocket debugging proxy. Prior to 2.10.3, lib/service/service.js handles GET /cgi-bin/temp/get by reading req.query.filename, joining it to TEMPFILESPATH only when it matches the temporary file pattern, and otherwise passing the user-supplied filename...
MCP Python SDK: WebSocket server transport does not support Host/Origin validation
Summary In affected versions, the deprecated WebSocket server transport mcp.server.websocket.websocketserver accepted the WebSocket handshake without applying any Host or Origin header validation. The TransportSecuritySettings mechanism that the SSE and Streamable HTTP transports use for this...
GHSA-JPW9-PFVF-9F58 MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal
Summary In affected versions, the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the session identifier, without verifying that the request was authenticated as the same principal that created the session. Anyone who learned or guessed a...