10098 matches found
ROS-20260911-73-0031
The vulnerability of the WebUI components in Google Chrome and Microsoft Edge relates to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain access to confidential data remotely...
PT-2026-90542
Name of the Vulnerable Software and Affected Versions Shopper versions 2.0.0 through 2.9.1 Description Authenticated users with the access setting permission can perform unauthorized destructive actions via the Livewire endpoint. This occurs because four Livewire components in the Settings area d...
ROS-20260911-73-0036
The vulnerability of the GPU components in Google Chrome and Microsoft Edge browsers is related to buffer overflows in the stack. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially crafted HTML page...
CVE-2026-81211
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary Python code due to improper authorization of custom components in stored flows...
CVE-2026-81211
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary Python code due to improper authorization of custom components in stored flows...
CVE-2026-81211 Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary Python code due to improper authorization of custom components in stored flows...
CVE-2026-81211
IBM Langflow OSS versions 1.0.0 through 1.11.5 are vulnerable to arbitrary Python code execution by a remote authenticated attacker. The root cause is a missing authorization check (CWE-862): the LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY policy is enforced on the direct custom-component endpoint but n...
CVE-2026-81211 Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary Python code due to improper authorization of custom components in stored flows...
ROS-20260910-73-0011
The vulnerability of the GPU components in Google Chrome and Microsoft Edge relates to buffer overflow attacks. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially crafted HTML page...
ROS-20260910-73-0077
The vulnerability of the GPU components in Google Chrome and Microsoft Edge relates to the disclosure of information. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data through a specially created HTML page...
CVE-2026-81211: Missing Authorization
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary Python code due to improper authorization of custom components in stored flows...
ROS-20260910-73-0136
The vulnerability of PDF components in Google Chrome and Microsoft Edge browsers is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to manipulate data integrity through a specially created HTML page...
ROS-20260910-73-0109
The vulnerability of XML components in Google Chrome and Microsoft Edge browsers is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data and compromise its integrity through a...
Missing Authorization
Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Missing Authorization in the GET /api/v1/hardware//assigned/components endpoint, which does not properly enforce the required permission check. An attacker can access...
CVE-2026-86764
Snipe-IT through 8.6.4 (fixed in 8.7.0 ) does not enforce the components.view permission on the authenticated endpoint GET /api/v1/hardware//assigned/components . The endpoint authorizes only assets.view on the parent asset before returning linked component details; the components.view check is a...
CVE-2026-86764 Snipe-IT 8.6.4 before 8.7.0 Permission Bypass via assigned components
Snipe-IT through 8.6.4 fixed in 8.7.0 does not enforce the components.view permission on the authenticated endpoint GET /api/v1/hardware//assigned/components. The endpoint authorizes only assets.view on the parent asset before returning linked component details; the components.view check is appli...
CVE-2026-86764 Snipe-IT 8.6.4 before 8.7.0 Permission Bypass via assigned components
Snipe-IT through 8.6.4 fixed in 8.7.0 does not enforce the components.view permission on the authenticated endpoint GET /api/v1/hardware//assigned/components. The endpoint authorizes only assets.view on the parent asset before returning linked component details; the components.view check is appli...
CVE-2026-86764 Snipe-IT 8.6.4 before 8.7.0 Permission Bypass via assigned components
Snipe-IT through 8.6.4 fixed in 8.7.0 does not enforce the components.view permission on the authenticated endpoint GET /api/v1/hardware//assigned/components. The endpoint authorizes only assets.view on the parent asset before returning linked component details; the components.view check is appli...
Security Bulletin: Multiple vulnerabilities found in CICS Transaction Gateway for Multiplatforms.
Summary Multiple vulnerabilities were identified in third-party components used by CICS Transaction Gateway for Multiplatforms, including IBM WebSphere Application Server, IBM WebSphere Application Server Liberty, Apache Tomcat Embed, Logback, Log4j, Jackson Databind, and various operating system...