68481 matches found
PT-2026-60387
Name of the Vulnerable Software and Affected Versions OpenFeature Operator versions prior to 0.9.3 Description On multi-tenant clusters using namespaces as trust boundaries, a tenant capable of creating a controller-owned workload can reference a FeatureFlagSource or InProcessConfiguration in a...
CVE-2026-45737: Exposure of Sensitive Information to an Unauthorized Actor
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 3.2.0 until 3.2.12, 3.3.10, and 3.4.2, Argo CD ServerSideDiff can expose Kubernetes Secret values embedded in the kubectl.kubernetes.io/last-applied-configuration annotation because HideSecretDatatarget, live, ... does...
PT-2026-60371
Name of the Vulnerable Software and Affected Versions FiftyOne versions prior to 1.17.0 Description The FiftyOne App/API server and the /media endpoint unconditionally set a permissive Cross-Origin Resource Sharing CORS header, allowing any website visited by a user to make cross-origin requests ...
CVE-2026-30623
LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality. The application allows users to add MCP servers via a JSON configuration specifying arbitrary command and args values. LiteLLM executes these values on the host without validation, enabling...
Siemens SICAM 8 product configuration error vulnerability
Siemens CPCI85 Central Processing/Communication is a central processing and communication device developed by the German company Siemens. Siemens SICORE Base system is a core foundational software component of the SICAM 8 power automation platform, designed specifically for substation automation...
CVE-2026-46485: External Control of System or Configuration Setting
Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can allow unauthenticated users or non-admin authenticated users to write changes to the main config.yaml through the config-saving functionality despite configured permissions, allowing unauthorized...
CVE-2026-30623: Improper Neutralization of Special Elements used in a Command
LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality. The application allows users to add MCP servers via a JSON configuration specifying arbitrary command and args values. LiteLLM executes these values on the host without validation, enabling...
CVE-2025-32781: Authorization Bypass Through User-Controlled Key
Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.0, Apollo Portal does not verify application and namespace permissions when an authenticated user requests a release by ID through GET /envs/env/releases/releaseId while...
CVE-2026-55242: Incorrect Authorization
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, an authenticated user with a standard operational role can trigger server-side template injection through a configuration field, resulting in unauthorized disclosure of data outside the user's norm...
CVE-2026-55723: Improper Neutralization of Equivalent Special Elements
When NGINX Ingress Controller is configured with Custom Resource Definitions CRDs or Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without...
PT-2026-60137
Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.78 Description The software fails to safely encode deployment configuration values during the generation of Python source code for API servers. This allows attackers to inject arbitrary Python expressions via th...
PT-2026-60183
Name of the Vulnerable Software and Affected Versions NGINX Ingress Controller affected versions not specified Description An injection flaw exists in the configuration generator when the software is configured with Custom Resource Definitions CRDs or Ingress annotations. Multiple user-controllab...
CVE-2025-56361
A reachable assertion vulnerability exists in the Matter SDK connectedhomeip 1.3 thru 1.4, specifically within the Level Control cluster's server tick logic emberAfLevelControlClusterServerTickCallback. When a MoveToLevel command is executed and followed by a conflicting write to the OperationMod...
JLSEC-2026-743 When `HAVE_ENCRYPT_THEN_MAC` is configured, the implementation could fall back to MAC-then-Encrypt...
When HAVEENCRYPTTHENMAC is configured, the implementation could fall back to MAC-then-Encrypt rather than enforcing Encrypt-then-MAC...
EUVD-2026-44352
Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network...
Umbraco.AI discloses sensitive application configuration values
Impact Under certain configurations, a user with elevated privileges may be able to cause sensitive application configuration values, potentially including secret material such as credentials, to be disclosed. Successful exploitation could expose confidential information and, depending on what th...
GHSA-Q3V2-XJ35-9GRX Umbraco.AI discloses sensitive application configuration values
Impact Under certain configurations, a user with elevated privileges may be able to cause sensitive application configuration values, potentially including secret material such as credentials, to be disclosed. Successful exploitation could expose confidential information and, depending on what th...
CVE-2026-47301
Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network...
CVE-2026-47301
Technical details about CVE-2026-47301 are not publicly available in the provided documents. No affected products, components, versions, or fixes are specified here. Monitor for updates.