24719 matches found
PT-2026-82096
Name of the Vulnerable Software and Affected Versions GitLab EE versions 19.1 through 19.1.6 GitLab EE versions 19.2 through 19.2.4 GitLab EE versions 19.3 through 19.3.0 Description An issue exists where an authenticated user with developer-role permissions can influence the execution environmen...
PT-2026-82099
Name of the Vulnerable Software and Affected Versions GitLab EE versions 11.3 through 19.1.6 GitLab EE versions 19.2 through 19.2.4 GitLab EE versions 19.3 Description An improper authorization check allows an authenticated user with project Maintainer permissions to access the terminal of a...
GitLab 19.1 < 19.1.7 / 19.2 < 19.2.5 / 19.3 < 19.3.1 (CVE-2026-15387)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with...
GitLab 11.3 < 19.1.7 / 19.2 < 19.2.5 / 19.3 < 19.3.1 (CVE-2026-3035)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with projec...
CVE-2026-57170
compliance-trestle (Trestle), a Python SDK for managing OSCAL compliance documents, is vulnerable to server-side template injection in versions prior to 3.12.4 and 4.0.0 through 4.0.3. The custom Jinja2 include tags (mdsection_include and md_clean_include) re-parse included Markdown file content ...
CVE-2026-57170 Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)
Compliance-trestle Trestle is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions prior to 3.12.4 and 4.0.0 through 4.0.3, the custom Jinja2 include tags mdsectioninclude and mdcleaninclude re-parse the content of an included Markdown file as Jinja2 template co...
CVE-2026-57170 Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)
Compliance-trestle Trestle is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions prior to 3.12.4 and 4.0.0 through 4.0.3, the custom Jinja2 include tags mdsectioninclude and mdcleaninclude re-parse the content of an included Markdown file as Jinja2 template co...
CVE-2026-57170 Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)
Compliance-trestle Trestle is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions prior to 3.12.4 and 4.0.0 through 4.0.3, the custom Jinja2 include tags mdsectioninclude and mdcleaninclude re-parse the content of an included Markdown file as Jinja2 template co...
CVE-2026-54757
Compliance-trestle Trestle is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, Trestle is vulnerable to server-side template injection that can lead to remote code execution. This occurs because the...
CVE-2026-15088
Vulnerability in Drupal Development Environment. This issue affects Development Environment versions:...
CVE-2026-15088 Development Environment - Critical - Unsupported - SA-CONTRIB-2026-089
Vulnerability in Drupal Development Environment. This issue affects Development Environment versions:...
CVE-2026-15088
A vulnerability exists in Drupal Development Environment (all versions). The software has been marked as unsupported by the security team due to a known security issue that remains unfixed by the maintainer . Rapid7 identifies the root cause as Improper Input Validation . No specific remediation ...
CVE-2026-15088 Development Environment - Critical - Unsupported - SA-CONTRIB-2026-089
Vulnerability in Drupal Development Environment. This issue affects Development Environment versions:...
mcp-contextforge-gateway has Server-Side Template Injection (SSTI) leading to Remote Code Execution in `PromptService._render_template` via unsandboxed Jinja2 Environment
Summary mcpgateway.services.promptservice.PromptService renders user-supplied prompt templates using Jinja2's plain Environment rather than SandboxedEnvironment. An authenticated user with permission to register or update prompt templates can store a malicious template that, on subsequent...
Uncontrolled Search Path Element
Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to Uncontrolled Search Path Element through the bundled xmllint tool in the underlying dependency. An attacker can potentially influence the search path used for external libraries ...
CVE-2026-21758
HCL Hive is affected by an information disclosure vulnerability, which could lead to an attacker gathering sensitive information about the host environment...
CVE-2026-21758 HCL Hive is affected by multiple security vulnerabilities.
HCL Hive is affected by an information disclosure vulnerability, which could lead to an attacker gathering sensitive information about the host environment...
CVE-2026-21758
HCL Hive is affected by an information disclosure vulnerability that could allow an attacker to gather sensitive information about the host environment . The CVSS v3.1 score is 3.7 (LOW) , with a network attack vector, high attack complexity , no required privileges, and low confidentiality impac...
CVE-2026-21758 HCL Hive is affected by multiple security vulnerabilities.
HCL Hive is affected by an information disclosure vulnerability, which could lead to an attacker gathering sensitive information about the host environment...
