60820 matches found
GHSA-3XR2-3348-786H vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-42W5-9CQV-WQ6X vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2026-17556 Path traversal in GitHub Enterprise Server allowed unauthenticated deletion of instance storage via the X-GitHub-Request-Id header
A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete arbitrary files and directories on the instance, including the entire user storage directory containing Git LFS objects, release assets, attachments, and avatars. The...
CVE-2026-17556 Path traversal in GitHub Enterprise Server allowed unauthenticated deletion of instance storage via the X-GitHub-Request-Id header
A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete arbitrary files and directories on the instance, including the entire user storage directory containing Git LFS objects, release assets, attachments, and avatars. The...
GHSA-945V-V9P3-V5XW rclone local `--metadata` applies attacker-controlled mode/uid - setuid binary planted from an untrusted remote
Summary When writing an object with metadata, the local backend applies the source-supplied mode, uid, and gid verbatim: it parses mode as an octal integer and passes it straight into os.Chmodo.path, os.FileModeumode, and passes uid/gid straight into os.Chown. The value is never masked to...
CVE-2026-8183
creationtimestamp| type| source ---|---|--- 2026-08-05 20:01:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msecymdlna2t...
CVE-2026-9130
IBM Langflow OSS 1.0.0 through 1.10.3 contain an authorization bypass vulnerability in the MemoryComponent that allows authenticated users to access chat history of other users via sessionid collision. The MemoryComponent.retrievemessages and storemessage methods filter on sessionid without...
CGA-92X5-JPJ2-28QR
Bulletin has no description...
CVE-2026-9130
CVE-2026-9130 affects IBM Langflow OSS versions 1.0.0–1.10.3. The root cause is an authorization bypass in the MemoryComponent where session_id is used to filter messages without validating flow_id or user_id ownership, enabling cross‑user information disclosure. This impacts multi‑user deploymen...
CVE-2026-9130 Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement
IBM Langflow OSS 1.0.0 through 1.10.3 contain an authorization bypass vulnerability in the MemoryComponent that allows authenticated users to access chat history of other users via sessionid collision. The MemoryComponent.retrievemessages and storemessage methods filter on sessionid without...
CVE-2026-9130 Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement
IBM Langflow OSS 1.0.0 through 1.10.3 contain an authorization bypass vulnerability in the MemoryComponent that allows authenticated users to access chat history of other users via sessionid collision. The MemoryComponent.retrievemessages and storemessage methods filter on sessionid without...
CVE-2026-9130
IBM Langflow OSS 1.0.0 through 1.10.3 contain an authorization bypass vulnerability in the MemoryComponent that allows authenticated users to access chat history of other users via sessionid collision. The MemoryComponent.retrievemessages and storemessage methods filter on sessionid without...
CVE-2026-70446
Missing permission checks in Jenkins CodeSonar Plugin 3.6.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...
EUVD-2026-53529
A missing permission check in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...
GHSA-7PGQ-CR25-XVC8
creationtimestamp| type| source ---|---|--- 2026-08-05 16:00:04+00:00| published-proof-of-concept| https://t.me/bdufstecru/3364 2026-08-06 00:00:34+00:00| published-proof-of-concept| https://t.me/bdufstecru/3364...
MAL-2026-13352 Malicious code in stellar-api-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd4c86bebaa61a9aada2c1686d68eb5119025ea4646426ea7da3db4ce4208707 The package's constructor unconditionally appends a hardcoded Discord user ID 1489655840662093854 to the caller-supplied adminIds list, granting that...
CVE-2026-17613
Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite any files on the target server and subscribe to WebSocket events, enabling full data exfiltration and data poisoning...
EUVD-2026-53386
Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite any files on the target server and subscribe to WebSocket events, enabling full data exfiltration and data poisoning...
CVE-2026-17613
Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite any files on the target server and subscribe to WebSocket events, enabling full data exfiltration and data poisoning...