389614 matches found
CLEANSTART-2026-ED66251 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor
Security vulnerability affects the strimzi-kafka-operator package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...
CLEANSTART-2026-AS15122 Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform
Security vulnerability affects the strimzi-kafka-operator package. Using untrusted, non-normalized input as-is for metrics data such as metric names, tag keys, or tag values is a dangerous antipattern that general-purpose instrumentation should never perform...
CLEANSTART-2026-WG41098 temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com
Security vulnerability affects the strimzi-kafka-operator package. A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com...
kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry
A flaw was found in the Linux kernel's Server Message Block over Remote Direct Memory Access SMC-Rv2 protocol implementation. The smcllcrmtdeleterkey and smcllcsaveaddlinkrkeys functions incorrectly handle oversized LLC messages, reading beyond the intended message boundaries. This can lead to th...
EUVD-2026-101736
n8n before 1.123.83 contains an authorization bypass vulnerability that allows authenticated members to spoof workflow identity by supplying a trusted identifier in Execute Sub-workflow inline JSON mode. Attackers can set this identifier to resolve credentials from projects they do not belong to...
RLSA-2026:82858 Important: python36:3.6 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...
python36:3.6 security update
An update is available for module.python-pygments, module.python-docutils, python-pymongo, module.python-pymongo, module.python-wheel, python-wheel, python-pygments, module.python-distro, python-docs, module.scipy, module.python-PyMySQL, module.python-docs, python-nose, python-PyMySQL,...
CVE-2026-110934: Improper Validation of Array Index
Improper validation of array index vulnerability in Samsung Open Source Vyond allows Input Data Manipulation. This issue affects Vyond: before be6e297b0c4836e20d73b2f8a40a561ea496ebaa...
PT-2026-114997
Name of the Vulnerable Software and Affected Versions OPNsense versions prior to 26.1.11 Description The OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view fail to apply quote-safe encoding to the common name of a client when...
CVE-2026-41544: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: QcalAgent 1.1.10 and...
CVE-2026-55842: Origin Validation Error
Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, the apiCorsConfiguration method in src/main/java/com/erudika/scoold/ScooldServer.java combines addAllowedOriginPattern"" with setAllowCredentialstrue, causing Spring to reflect any requesting origin while allowing cookie...
CVE-2026-109695: Insertion of Sensitive Information Into Sent Data
Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja FluentCart fluent-cart allows Retrieve Embedded Sensitive Data.This issue affects FluentCart: from n/a through 1.7.1...
CVE-2026-110361: Insertion of Sensitive Information Into Sent Data
Insertion of Sensitive Information Into Sent Data vulnerability in ClikIT Infinite Uploads infinite-uploads allows Retrieve Embedded Sensitive Data.This issue affects Infinite Uploads: from n/a through 3.4.1...
Important: ghostscript security update
The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fixes: ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and...
Microsoft .NET Framework (October 2026)
The Microsoft .NET Framework installation on the remote host is missing a security update. It is, therefore, affected by multiple vulnerabilities, including the following: - Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network. CVE-2026-70007 -...
CVE-2026-108116: Improper Neutralization of Special Elements in Output Used by a Downstream Component
In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection...
CVE-2026-24718: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central...
CVE-2025-66272: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8...
CVE-2026-39993: Relative Path Traversal
A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version:...
PT-2026-115292
Name of the Vulnerable Software and Affected Versions Likeshop versions prior to 3.5.2 Description An insecure direct object reference issue exists in AfterSale.php and AfterSaleLogic.php. Authenticated users with self-registered accounts can access after-sale records of other customers by...