55739 matches found
CVE-2026-45095
Unknown description...
CVE-2026-45093
Unknown description...
CVE-2026-53588
Unknown description...
CGA-5C6C-7C59-Q4HR
Bulletin has no description...
CGA-2QV9-98P3-HG8F
Bulletin has no description...
Security Bulletin: IBM watsonx.data integration has several vulnerabilities due to open source software
Summary Open source packages are used as part of the overall processing in IBM watsonx.data integration. Vulnerability Details CVEID:CVE-2026-33814 DESCRIPTION: When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a...
CVE-2026-59708
The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts private access IDs without validating granteeUserId filtering, allowing unauthenticated access to full portfolio data. Attackers with a private access ID can retrieve sensitive portfolio information including holdings,...
CGA-2HX2-PPWQ-57JC
Bulletin has no description...
PYSEC-2026-1460 Indico may disclose unauthorized user details access via legacy API
Impact A legacy API to retrieve user details could be misused to retrieve profile details of other users without having admin permissions due to a broken access check. Patches You should to update to Indico 3.3.8 as soon as possible. See the docs for instructions on how to update. Workarounds It ...
SUSE CVE-2026-58386
unknown...
PYSEC-2026-1441 H2O Vulnerable to Arbitrary File Overwrite
In h2oai/h2o-3 version 3.46.0, the /99/Models/name/json endpoint allows for arbitrary file overwrite on the target server. The vulnerability arises from the exportModelDetails function in ModelsHandler.java, where the user-controllable mexport.dir parameter is used to specify the file path for...
PYSEC-2026-1076 AgentScope stored cross-site scripting (XSS) vulnerability
A stored cross-site scripting XSS vulnerability exists in modelscope/agentscope, as of the latest commit 21161fe on the main branch. The vulnerability occurs in the view for inspecting detailed run information, where a user-controllable string run ID is appended and rendered as HTML. This allows ...
PYSEC-2026-1263 composio allows Server-Side Request Forgery (SSRF) in BROWSERTOOL
A Server-Side Request Forgery SSRF vulnerability exists in composiohq/composio version v0.4.4. This vulnerability allows an attacker to read the contents of any file in the system by exploiting the BROWSERTOOLGOTOPAGE and BROWSERTOOLGETPAGEDETAILS actions...
Open WebUI Allows Viewing of Admin Details
An improper access control vulnerability in open-webui/open-webui v0.3.8 allows an attacker to view admin details. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the /api/v1/auths/admin/details interface to retrieve the first admin...
PYSEC-2026-1735 Open WebUI Allows Viewing of Admin Details
An improper access control vulnerability in open-webui/open-webui v0.3.8 allows an attacker to view admin details. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the /api/v1/auths/admin/details interface to retrieve the first admin...
Malicious code in sitefinitywebapp (npm)
--- -= Per source details. Do not edit below this line.=-...
Improper Removal of Sensitive Information Before Storage or Transfer
Overview Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer in the REST API task-instance detail and list endpoints, which returned deferred task trigger keyword arguments without masking sensitive data. An attacker can access...
Malicious code in zlx4576 (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
