260245 matches found
CVE-2026-54659
Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, Pagy::I18n.locale= in gem/lib/pagy/modules/i18n/i18n.rb stored locale values verbatim and later used them as .yml path components, allowing untrusted params:locale values with absolute paths or ../ sequences to create a file...
EUVD-2026-50087
openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in internal/server/publicproxy.go forwarded r.URL.Path instead of preserving the original request target with r.URL.EscapedPath, allowing percent encoded dot segments %2e and separators %2f to reach...
CVE-2026-54653
The CVE affects the datamodel-code-generator project. From versions 0.17.0 through 0.60.2, the tool could preserve attacker-controlled default_factory values in JsonSchemaObject.init/get_field_extras, emitting them into Field(default_factory=...) and enabling Python expression execution when the ...
EUVD-2026-50076
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.63.0, datamodel-code-generator validates a URL host once in src/datamodelcodegenerator/http.py through...
CVE-2026-49447
Cosmos-Server 0.22.18 reportedly exposes constellation device metadata via GET /cosmos/api/constellation/public-devices when any non-empty Authorization header is provided; the code strips Bearer but does not validate or use the token in the DB query, allowing unauthenticated-like access to devic...
CVE-2026-16581 Inclusion of sensitive information in source code in igloohome Smart Lock Mobile Application
In igloohome Smart Lock Mobile App versions 3.2.3 and prior, an Inclusion of Sensitive Information in Source Code vulnerability could allow an unauthorized actor to access functions or backend services that were not sufficiently protected by authentication controls...
EUVD-2026-50015
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service vulnerability when the restConnector-2.0 feature is enabled...
CVE-2026-48388
creationtimestamp| type| source ---|---|--- 2026-07-28 19:22:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrq53ijlk62q...
CVE-2026-66745
creationtimestamp| type| source ---|---|--- 2026-07-28 19:09:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrq4e5jyet2i 2026-07-28 20:00:56+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrq77z7zsg2e...
CVE-2026-47768
CVE-2026-47768 affects nebula-mesh up to and including v0.3.1, where newly minted operator API keys are exposed in the redirect URL?new_key and related query strings. The root cause is tokens being placed in the URL during the handleOperatorCreateAPIKey flow, making them observable via the browse...
CVE-2026-66748
creationtimestamp| type| source ---|---|--- 2026-07-28 17:01:00+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrpv6bv23f2w...
pipewire: PipeWire: Sandbox escape and arbitrary code execution via malicious library loading
A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library,...
CVE-2026-41874
creationtimestamp| type| source ---|---|--- 2026-07-28 16:15:08+00:00| seen| https://cert.pl/en/posts/2026/07/CVE-2026-41874...
EUVD-2026-49877
WordPress Coding Standards is a set of PHPCodeSniffer rules sniffs that enforce WordPress coding conventions. From 0.14.1 until 3.4.1, the WordPress.WP.EnqueuedResourceParameters sniff active in the WordPress and WordPress-Extra rulesets reconstructed the $ver argument passed to functions such as...
CVE-2026-62436
creationtimestamp| type| source ---|---|--- 2026-07-28 14:56:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrpo7czz472g 2026-07-28 15:12:57+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mrpp535lxd22...
CVE-2026-54545
wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlled module filenames only once before writing extracted modules, so a crafted filename containing overlapping traversal sequences such as ....// collapses to ../ after sanitizatio...
EUVD-2026-49869
wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlled module filenames only once before writing extracted modules, so a crafted filename containing overlapping traversal sequences such as ....// collapses to ../ after sanitizatio...
ROOT-OS-UBUNTU-2404-CVE-2026-53163 CVE-2026-53163 in rootio-linux - Patched by Root
Root has patched CVE-2026-53163 in the rootio-linux package for Root:Ubuntu:24.04. Multiple fixed versions available...