25910 matches found
PT-2026-32511
Name of the Vulnerable Software and Affected Versions Craft Commerce versions prior to 4.11.0 Craft Commerce versions prior to 5.6.0 Description The actionPay function in the 'PaymentsController' discloses order data to unauthenticated users. This occurs when an order number is provided and the...
PT-2026-51967
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth component where HCI UART PROTO INIT is not cleared when hci register dev fails within the hci uart register dev function. This failure allows incoming UA...
CVE-2026-31426
In the Linux kernel, the following vulnerability has been resolved: ACPI: EC: clean up handlers on probe failure in acpiecsetup When ecinstallhandlers returns -EPROBEDEFER on reduced-hardware platforms, it has already started the EC and installed the address space handler with the struct acpiec...
EUVD-2026-21684
A security vulnerability has been detected in perfree go-fastdfs-web up to 1.3.7. This affects an unknown part of the file src/main/java/com/perfree/controller/InstallController.java of the component doInstall Interface. The manipulation leads to improper authorization. The attack may be initiate...
CVE-2026-6105 perfree go-fastdfs-web doInstall InstallController.java improper authorization
A security vulnerability has been detected in perfree go-fastdfs-web up to 1.3.7. This affects an unknown part of the file src/main/java/com/perfree/controller/InstallController.java of the component doInstall Interface. The manipulation leads to improper authorization. The attack may be initiate...
CVE-2026-6105
A security vulnerability has been detected in perfree go-fastdfs-web up to 1.3.7. This affects an unknown part of the file src/main/java/com/perfree/controller/InstallController.java of the component doInstall Interface. The manipulation leads to improper authorization. The attack may be initiate...
CVE-2026-6105 perfree go-fastdfs-web doInstall InstallController.java improper authorization
A security vulnerability has been detected in perfree go-fastdfs-web up to 1.3.7. This affects an unknown part of the file src/main/java/com/perfree/controller/InstallController.java of the component doInstall Interface. The manipulation leads to improper authorization. The attack may be initiate...
CVE-2026-35206 vulnerabilities
Vulnerabilities for packages: pluto, cilium-cli, cluster-api-helm-controller, k8sgpt, harbor, kubescape, tigera-operator, trivy-operator, zarf, helm-push, helm, flux, kuma, zot, helm-mapkubeapis, tw, helm-operator, k9s, cert-manager-cmctl, k8ssandra-client, flux-source-controller, eksctl, linkerd...
GHSA-HR2V-4R36-88HR vulnerabilities
Vulnerabilities for packages: pluto, cilium-cli, cluster-api-helm-controller, k8sgpt, harbor, kubescape, tigera-operator, trivy-operator, zarf, helm-push, helm, flux, kuma, zot, helm-mapkubeapis, tw, helm-operator, k9s, cert-manager-cmctl, k8ssandra-client, flux-source-controller, eksctl, linkerd...
GHSA-FV83-X2XW-2J55 vulnerabilities
Vulnerabilities for packages: aws-load-balancer-controller, pluto, actions-runner-controller, flux-image-automation-controller, secrets-store-csi-driver-provider-aws, mariadb-operator, osv-scanner, smokescreen, dataplaneapi, local-path-provisioner, flux-helm-controller, metacontroller,...
GHSA-7MR4-XJXG-34G6 vulnerabilities
Vulnerabilities for packages: rclone, sftpgo-plugin-eventstore, vault-secrets-webhook, db-operator, vault-env, cilium-cli, kube-fluentd-operator, x509-certificate-exporter, caddy, harbor, promxy, boring-registry, grafana-rollout-operator, weaviate, yunikorn-k8shim, ingress-nginx-controller, tkn,...
GHSA-JRG3-GFJW-HM96 vulnerabilities
Vulnerabilities for packages: rclone, nats-top, sftpgo-plugin-eventstore, victoriametrics-operator, rabbitmq-default-user-credential-updater, vault-env, harbor, boring-registry, task, docker-credential-acr-env, nri-elasticsearch, cri-tools, kaf, ipfs-cluster, sftpgo-plugin-auth, gostatsd,...
CVE-2026-32283 vulnerabilities
Vulnerabilities for packages: rclone, nats-top, sftpgo-plugin-eventstore, victoriametrics-operator, rabbitmq-default-user-credential-updater, vault-env, harbor, boring-registry, task, docker-credential-acr-env, nri-elasticsearch, cri-tools, kaf, ipfs-cluster, sftpgo-plugin-auth, gostatsd,...
CVE-2026-32281 vulnerabilities
Vulnerabilities for packages: rclone, nats-top, sftpgo-plugin-eventstore, victoriametrics-operator, rabbitmq-default-user-credential-updater, vault-env, harbor, boring-registry, task, docker-credential-acr-env, nri-elasticsearch, cri-tools, kaf, ipfs-cluster, kubernetes-csi-driver-hostpath,...
CVE-2026-35206 vulnerabilities
Vulnerabilities for packages: helm-exporter, helm-diff-fips, envoy-gateway, cilium-cli, chartmuseum, harbor-fips, cloudbeat-fips, helm-exporter-fips, gitlab-operator, trivy, trivy-operator, zarf, cert-manager-cmctl-fips, helm-set-status, kubescape-server-fips, linkerd2-fips, jfrog-cli, cerbos,...
GHSA-5W89-2C2X-6X66 vulnerabilities
Vulnerabilities for packages: vault-secrets-webhook, mc, manifest-tool, filebrowser, kiam, ceph-csi-operator-fips, k3d, pulumi, wgcf, prometheus-postgres-exporter, k8sgpt-operator, gobuster, cert-manager-csi-driver, kuberlr, act, knative-eventing-fips, terraform-provider-random-fips,...
CVE-2026-32283 vulnerabilities
Vulnerabilities for packages: prometheus-mysqld-exporter-fips, hcloud, mcp-grafana-fips, whereabouts, gpu-operator-fips, vault-secrets-webhook, gostatsd, mc, crossplane-provider-aws-acm-fips, trivy-operator, mc-fips, task, knative-operator, manifest-tool, crossplane-function-auto-ready-fips,...
PT-2026-32126
A security vulnerability has been detected in perfree go-fastdfs-web up to 1.3.7. This affects an unknown part of the file src/main/java/com/perfree/controller/InstallController.java of the component doInstall Interface. The manipulation leads to improper authorization. The attack may be initiate...
Juju: CloudSpec method leaking cloud credentials
Impact If a user has login permission to a controller and knows the controller model UUID, they can call the CloudSpec method on the Controller facade and get cloud credentials used to bootstrap the controller. The CloudSpec API is called by workers running in the controller to maintain connectio...
GHSA-W5FQ-8965-C969 Juju: CloudSpec method leaking cloud credentials
Impact If a user has login permission to a controller and knows the controller model UUID, they can call the CloudSpec method on the Controller facade and get cloud credentials used to bootstrap the controller. The CloudSpec API is called by workers running in the controller to maintain connectio...