260 matches found
CVE-2026-114058
ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that lets authenticated users read other databases' schema metadata. Attackers with credentials for one database can set the db field in RUN or BEGIN messages and call db.labels or SHOW...
EUVD-2026-107009
ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that lets authenticated users read other databases' schema metadata. Attackers with credentials for one database can set the db field in RUN or BEGIN messages and call db.labels or SHOW...
CVE-2026-114058
ArcadeDB versions 26.2.1 before 26.10.1 are vulnerable to a missing authorization flaw in the Bolt protocol handler . This vulnerability allows authenticated users to access and read schema metadata for other databases. Specifically, an attacker with credentials for a single database can manipula...
CVE-2026-114058 ArcadeDB from 26.2.1 before 26.10.1 Missing Authorization via Bolt Protocol
ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that lets authenticated users read other databases' schema metadata. Attackers with credentials for one database can set the db field in RUN or BEGIN messages and call db.labels or SHOW...
PT-2026-120184
ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that lets authenticated users read other databases' schema metadata. Attackers with credentials for one database can set the db field in RUN or BEGIN messages and call db.labels or SHOW...
PT-2026-116030
Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manage options users. Attackers can call dt verify external connection with a chosen endpointId and url to send stored connection...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: drbd: fixed the “LOGIC BUG” in drbdalbeginiononblock Although we ensure that we can perform lcgetcumulative while holding the device-allock spinlock, it may still fail if some other code path decides to use lctrylock at the wrong...
Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: zonefs: fixed zonefsiomapbegin for reads. If a readahead operation is issued on a sequential zone file with an offset that exactly equals the current file size, the iomap type is set to IOMAPUNWRITTEN, which will prevent any I/O...
PT-2026-94768
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An infinite loop exists in the nilfs2 file system within the nilfs clean segments function. This occurs when the cleaner ioctl is executed and the nilfs segctor construct function...
PT-2026-94732
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The folio batch mechanism used for iomap zero range fails to release the batch during specific error scenarios. This occurs when calls to the -iomap begin or -iomap end functions fail,...
Astra Linux – Vulnerability in HAPProxy
A vulnerability related to information leaks was discovered in HAProxy versions 2.1, 2.2 before 2.2.27, 2.3, and 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, and 2.7 before 2.7.1. There are 5 bytes that are not initialized in the connection buffer when encoding the FCGIBEGINREQUEST...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: Drivers: Ethernet: cpsw – Fixed a panic that occurs when the coalece interrupt is set using ethtool. The cpswethtoolbegin function directly returns the result of pmruntimegetsync when it is successful. pmruntimegetsync returns...
PT-2026-78700
Name of the Vulnerable Software and Affected Versions Coturn version 4.15.0 Description An authenticated TURN user can repeatedly resume a single allocation from new UDP 5-tuples without completing a handoff when the server has the --mobility feature enabled. This occurs because the mobile begin...
ChurchCRM - Cross-Site Scripting Detection
A reflected cross-site scripting XSS vulnerability was discovered in ChurchCRM via the 'username' parameter in /session/begin. !/usr/bin/env python3 -- coding: utf-8 -- """A reflected cross-site scripting XSS vulnerability was discovered in ChurchCRM via the 'username' parameter .""" from...
CVE-2026-51251
...
CVE-2026-51251
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
PT-2026-65488
Schreibfaul1 ESP32-audioI2S 3.4.5 has a buffer overflow vulnerability in the MP3Decoder::decode function of the MP3 decoder due to missing size validation on untrusted mainDataBegin and nSlots values...
EUVD-2026-49857
Schreibfaul1 ESP32-audioI2S 3.4.5 has a buffer overflow vulnerability in the MP3Decoder::decode function of the MP3 decoder due to missing size validation on untrusted mainDataBegin and nSlots values...
CVE-2026-64526
In the Linux kernel, the following vulnerability has been resolved: ethtool: tsconfig: fix missing ethnlopscomplete tsconfigpreparedata calls ethnlopsbegin, we need to call ethnlopscomplete before returning the error...