374101 matches found
CVE-2026-107816
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qcinfo plugin could be confused by a query containing embedded null bytes. Reading informationschema.querycacheinfo after such a query was cached could acces...
CVE-2026-55797
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port...
CVE-2026-108158
plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the whiteboard conversion endpoint that allows any meeting participant to read server files via crafted filePath values. Attackers can supply ../ sequences so text or office documents are converted into page images, then...
SUSE CVE-2026-94439
When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...
SUSE CVE-2026-97031
Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector a...
CVE-2026-55797 Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port...
CVE-2026-55797 Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port...
CVE-2026-55797 Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port...
CVE-2026-55797
The Argo CD repo-server is vulnerable to command injection (CWE-78) in versions 2.11.0 through 3.3.15 , 3.4.10 , 3.5.4 , and 3.6.0-rc2 . The root cause is the execution of an SSH ProxyCommand containing a proxy host and port through a shell without neutralizing shell metacharacters. An attacker w...
EUVD-2026-95912
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port...
CVE-2026-55797
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port...
GHSA-J6CW-G6P4-7HCH Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL
Impact Argo CD runs a shell command in the repo-server when it clones or fetches an SSH Git repository that has a proxy URL. The proxy host and port are copied into an SSH ProxyCommand. A host that contains shell metacharacters breaks out of that command and runs in the repo-server. All versions...
Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL
Impact Argo CD runs a shell command in the repo-server when it clones or fetches an SSH Git repository that has a proxy URL. The proxy host and port are copied into an SSH ProxyCommand. A host that contains shell metacharacters breaks out of that command and runs in the repo-server. All versions...
CVE-2026-107815
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset...
CVE-2026-108158 plugNmeet Server through 2.5.2 Path Traversal via /api/whiteboard/convert
plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the whiteboard conversion endpoint that allows any meeting participant to read server files via crafted filePath values. Attackers can supply ../ sequences so text or office documents are converted into page images, then...
CVE-2026-108158
The plugNmeet Server through 2.5.2 version is vulnerable to a path traversal vulnerability in the /api/whiteboard/convert endpoint. An authenticated meeting participant can provide crafted filePath values containing ../ sequences to force the server to convert arbitrary files into page images. Th...
CVE-2026-108158 plugNmeet Server through 2.5.2 Path Traversal via /api/whiteboard/convert
plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the whiteboard conversion endpoint that allows any meeting participant to read server files via crafted filePath values. Attackers can supply ../ sequences so text or office documents are converted into page images, then...
EUVD-2026-95906
plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the whiteboard conversion endpoint that allows any meeting participant to read server files via crafted filePath values. Attackers can supply ../ sequences so text or office documents are converted into page images, then...
CVE-2026-107814
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege...