59165 matches found
CVE-2026-105139
Obot 0.26.0 before 0.26.2 contains an authorization bypass vulnerability that allows authenticated users matching any vMCP profile to reach prompts and resources of ungranted components. Because profiles were enforced only on tools, attackers can access prompts, resources, and resource templates...
EUVD-2026-94310
Obot 0.26.0 before 0.26.2 contains an authorization bypass vulnerability that allows authenticated users matching any vMCP profile to reach prompts and resources of ungranted components. Because profiles were enforced only on tools, attackers can access prompts, resources, and resource templates...
CVE-2026-105139
The Obot platform (versions 0.26.0 before 0.26.2 ) contains an authorization bypass vulnerability. The root cause is that vMCP profiles were only enforced on tools, failing to restrict access to other elements. This allows authenticated users matching any vMCP profile to access prompts , resource...
CVE-2026-105139 Obot 0.26.0 before 0.26.2 Authorization Bypass via vMCP Profile Prompts and Resources
Obot 0.26.0 before 0.26.2 contains an authorization bypass vulnerability that allows authenticated users matching any vMCP profile to reach prompts and resources of ungranted components. Because profiles were enforced only on tools, attackers can access prompts, resources, and resource templates...
CVE-2026-92533
Path traversal vulnerability in the BugTracker.NET file download component. The parameter used to specify the file name does not properly validate user-supplied paths. An authenticated remote attacker could enter a manipulated path to access files located outside the intended directory. Successfu...
CVE-2026-92533 Path Traversal in BugTracker.NET
Path traversal vulnerability in the BugTracker.NET file download component. The parameter used to specify the file name does not properly validate user-supplied paths. An authenticated remote attacker could enter a manipulated path to access files located outside the intended directory. Successfu...
CVE-2026-92533 Path Traversal in BugTracker.NET
Path traversal vulnerability in the BugTracker.NET file download component. The parameter used to specify the file name does not properly validate user-supplied paths. An authenticated remote attacker could enter a manipulated path to access files located outside the intended directory. Successfu...
CVE-2026-106334
An information leak flaw was found in the Payments component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/556229780...
CVE-2026-106269
An use after free flaw was found in the CSS component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/565742178...
CVE-2026-106417
An integer overflow flaw was found in the Media component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/536471438...
CVE-2026-106368
An ui misrepresentation flaw was found in the UI component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553252261...
CVE-2026-106309
An incorrect authorization flaw was found in the Selection component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/503708636...
CVE-2026-106210
An observable discrepancy flaw was found in the Scroll component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/556304559...
CVE-2026-106336
An observable discrepancy flaw was found in the Paint component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/522722456...
CVE-2026-106408
A protection mechanism failure flaw was found in the Mobile component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/504227656...
CVE-2026-92533: Path Traversal: '../filedir'
Path traversal vulnerability in the BugTracker.NET file download component. The parameter used to specify the file name does not properly validate user-supplied paths. An authenticated remote attacker could enter a manipulated path to access files located outside the intended directory. Successfu...
EUVD-2025-211052
The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log...
Graphics Component Microsoft Office Code Execution
The vulnerability of the Graphics Component component in the Microsoft Office software suite is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...
SUSE SLES12: MozillaFirefox / MozillaFirefox-devel / etc (SUSE-SU-2026:4543-1)
The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4543-1 advisory. Update to Firefox Extended Support Release 153.4.0 ESR MFSA 2026-100, bsc1282929: - CVE-2026-96869: Information disclosure in the...