CVE-2026-73680 Cockpit CMS 2.14.0 Authenticated Command Injection via FFmpeg Filename

Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is...

AWS CLI: Overly permissive File Permissions

SummaryThe AWS Command Line Interface AWS CLI is a unified tool for managing AWS services from the command line. Certain CLI subcommands wrote credential and configuration files with world-readable permissions on Unix-like systems with a default umask, allowing other local users on the same host ...

EUVD-2026-44910

An information disclosure vulnerability exists in Canonical ubuntu-pro-client formerly ubuntu-advantage-tools. The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in...

com.braimanm:uitaf (>=3.0.0, <=3.2.3), com.braimanm:uitaf-playwright (>=1.0.0-alpha, <=1.0.1-alpha) +7 more potentially affected by CVE-2026-55847 via io.qameta.allure:allure-generator (>=2.8.0, <=2.38.1)

io.qameta.allure:allure-generator MAVEN version =2.8.0, =3.0.0, =1.0.0-alpha, =1.1.0, =0.1.17, =0.1.17, =1.0-rc1, =2.8.0, =2.38.1 - org.uitaf:uitaf-playwright 1.0.1 Source cves: CVE-2026-55847 Source advisory: GHSA-GX93-M64W-5M6H...

com.braimanm:uitaf (>=3.0.0, <=3.2.3), com.braimanm:uitaf-playwright (>=1.0.0-alpha, <=1.0.1-alpha) +7 more potentially affected by CVE-2026-55847 via io.qameta.allure:allure-generator (>=2.8.0, <=2.38.1)

io.qameta.allure:allure-generator MAVEN version =2.8.0, =3.0.0, =1.0.0-alpha, =1.1.0, =0.1.17, =0.1.17, =1.0-rc1, =2.8.0, =2.38.1 - org.uitaf:uitaf-playwright 1.0.1 Source cves: CVE-2026-55847 Source advisory: OSV:GHSA-GX93-M64W-5M6H...

Allure Report: Path Traversal in HTTP Server Allows Arbitrary File Read

Summary The built-in HTTP server started by allure serve and allure open is vulnerable to path traversal. The server resolves request URI paths directly against the report directory without normalizing or validating that the resolved path stays within the report directory. An attacker who can rea...

com.braimanm:uitaf (>=3.0.0, <=3.2.3), com.braimanm:uitaf-playwright (>=1.0.0-alpha, <=1.0.1-alpha) +5 more potentially affected by CVE-2026-55846 via io.qameta.allure:allure-commandline (>=2.13.8, <=2.36.0)

io.qameta.allure:allure-commandline MAVEN version =2.13.8, =3.0.0, =1.0.0-alpha, =1.1.0, =0.1.17, =0.1.17, =1.0-rc1, =1.1.6 - org.uitaf:uitaf-playwright 1.0.1 Source cves: CVE-2026-55846 Source advisory: GHSA-82CG-3HV7-74GC...

com.braimanm:uitaf (>=3.0.0, <=3.2.3), com.braimanm:uitaf-playwright (>=1.0.0-alpha, <=1.0.1-alpha) +5 more potentially affected by CVE-2026-55846 via io.qameta.allure:allure-commandline (>=2.13.8, <=2.36.0)

io.qameta.allure:allure-commandline MAVEN version =2.13.8, =3.0.0, =1.0.0-alpha, =1.1.0, =0.1.17, =0.1.17, =1.0-rc1, =1.1.6 - org.uitaf:uitaf-playwright 1.0.1 Source cves: CVE-2026-55846 Source advisory: SNYK:JAVA-IOQAMETAALLURE-17732805...

com.braimanm:uitaf (>=3.0.0, <=3.2.3), com.braimanm:uitaf-playwright (>=1.0.0-alpha, <=1.0.1-alpha) +5 more potentially affected by CVE-2026-55846 via io.qameta.allure:allure-commandline (>=2.13.8, <=2.36.0)

io.qameta.allure:allure-commandline MAVEN version =2.13.8, =3.0.0, =1.0.0-alpha, =1.1.0, =0.1.17, =0.1.17, =1.0-rc1, =1.1.6 - org.uitaf:uitaf-playwright 1.0.1 Source cves: CVE-2026-55846 Source advisory: OSV:GHSA-82CG-3HV7-74GC...

Exploit for Out-of-bounds Write in Google Chrome

CVE-2023-4863 — Laboratorio de explotación de libwebp Reprodu...

Resource Injection

Overview Affected versions of this package are vulnerable to Resource Injection in the NuGetGallery backend job’s handling of .nuspec files within NuGet packages. An attacker can bypass intended validation by supplying specially crafted package metadata IDs or versions. Remediation Upgrade...

com.snowflake:snowpark (1.9.0), io.github.stewartbryson.snowflake:io.github.stewartbryson.snowflake.gradle.plugin (>=2.1.5, <=2.1.11) +3 more potentially affected by CVE-2026-3293 via net.snowflake:snowflake-jdbc (3.14.1)

net.snowflake:snowflake-jdbc MAVEN version 3.14.1 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc and may be impacted: - com.snowflake:snowpark 1.9.0 -...

net.snowflake:spark-snowflake_2.11 (>=2.5.8-spark_2.2, <=2.5.9-spark_2.4), net.snowflake:spark-snowflake_2.12 (>=2.5.8-spark_2.4, <=2.5.9-spark_2.4) +2 more potentially affected by CVE-2026-3293 via net.snowflake:snowflake-jdbc (3.12.0)

net.snowflake:snowflake-jdbc MAVEN version 3.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc and may be impacted: - net.snowflake:spark-snowflake2.11 =2.5.8-spark2.2, =2.5.8-spark2.4, =7.2.1, =7.2.1, =7.5.3 Source cves...

net.snowflake:spark-snowflake_2.11 (>=2.5.7-spark_2.2, <=2.5.7-spark_2.4), net.snowflake:spark-snowflake_2.12 (2.5.7-spark_2.4) +3 more potentially affected by CVE-2026-3293 via net.snowflake:snowflake-jdbc (3.11.1)

net.snowflake:snowflake-jdbc MAVEN version 3.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc and may be impacted: - net.snowflake:spark-snowflake2.11 =2.5.7-spark2.2, =6.4.1, =6.4.1, =6.2.2, =7.2.0 Source cves:...

net.snowflake:spark-snowflake_2.11 (>=2.5.5-spark_2.2, <=2.5.5-spark_2.4), net.snowflake:spark-snowflake_2.12 (2.5.5-spark_2.4) +1 more potentially affected by CVE-2026-3293 via net.snowflake:snowflake-jdbc (3.10.2)

net.snowflake:snowflake-jdbc MAVEN version 3.10.2 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc and may be impacted: - net.snowflake:spark-snowflake2.11 =2.5.5-spark2.2, =6.1.0, =6.2.1 Source cves: CVE-2026-3293 Source...

io.smartdatalake:sdl-snowflake_2.11 (>=1.2.4, <=1.3.2), io.smartdatalake:sdl-snowflake_2.12 (>=1.2.4, <=2.1.1) +4 more potentially affected by CVE-2026-3293 via net.snowflake:snowflake-jdbc (3.12.17)

net.snowflake:snowflake-jdbc MAVEN version 3.12.17 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc and may be impacted: - io.smartdatalake:sdl-snowflake2.11 =1.2.4, =1.2.4, =2.8.4-spark2.3, =2.8.4-spark2.4, =7.5.4, =7.5.4,...

com.buschmais.jqassistant.cli:jqassistant-commandline-neo4jv3 (1.9.0-rc1), com.buschmais.jqassistant.neo4jserver:bootstrap (1.9.0-rc1) +22 more potentially affected by CVE-2026-1337 via org.neo4j:neo4j (3.5.22)

org.neo4j:neo4j MAVEN version 3.5.22 is affected by a known vulnerability. The following packages have a transitive dependency on org.neo4j:neo4j and may be impacted: - com.buschmais.jqassistant.cli:jqassistant-commandline-neo4jv3 1.9.0-rc1 - com.buschmais.jqassistant.neo4jserver:bootstrap...

com.buschmais.jqassistant.cli:jqassistant-commandline-neo4jv5 (>=2.6.0-m1, <=2.6.0-m2), io.vertigo:vertigo-neo4j-connector (4.3.0) +18 more potentially affected by CVE-2026-1337 via org.neo4j:neo4j (5.25.1)

org.neo4j:neo4j MAVEN version 5.25.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.neo4j:neo4j and may be impacted: - com.buschmais.jqassistant.cli:jqassistant-commandline-neo4jv5 =2.6.0-m1, =2.6.0-m2 - io.vertigo:vertigo-neo4j-connector 4.3.0 -...

com.buschmais.jqassistant.cli:jqassistant-commandline-neo4jv4 (>=2.6.0-rc1, <=2.6.0), com.buschmais.jqassistant.cli:test (>=2.6.0-rc1, <=2.6.0) +20 more potentially affected by CVE-2026-1337 via org.neo4j:neo4j (4.4.41)

org.neo4j:neo4j MAVEN version 4.4.41 is affected by a known vulnerability. The following packages have a transitive dependency on org.neo4j:neo4j and may be impacted: - com.buschmais.jqassistant.cli:jqassistant-commandline-neo4jv4 =2.6.0-rc1, =2.6.0-rc1, =2.6.0-rc1, =2.6.0-rc1, =2.6.0-rc1, =2.6.0...

com.buschmais.jqassistant.cli:jqassistant-commandline-neo4jv4 (>=2.3.0-m2, <=2.3.1), com.buschmais.jqassistant.cli:test (>=2.3.0-m2, <=2.3.1) +23 more potentially affected by CVE-2026-1622 via org.neo4j:neo4j (4.4.34)

org.neo4j:neo4j MAVEN version 4.4.34 is affected by a known vulnerability. The following packages have a transitive dependency on org.neo4j:neo4j and may be impacted: - com.buschmais.jqassistant.cli:jqassistant-commandline-neo4jv4 =2.3.0-m2, =2.3.0-m2, =2.3.0-m2, =2.3.0-m2, =2.3.0-m2, =2.2.8,...