69416 matches found
EUVD-2026-37026
A flaw was found in the tracker-extract-mp3 component of GNOME localsearch previously known as tracker-miners. This vulnerability, a heap buffer overflow, occurs when processing specially crafted MP3 files. A remote attacker could exploit this by providing a malicious MP3 file, leading to a Denia...
PT-2026-50181
Name of the Vulnerable Software and Affected Versions Daytona versions prior to 0.185.0 Description Organization role update and delete endpoints authorized the caller as an owner of the organization in the request path but mutated the target role using only its identifier without verifying the...
KLA91105 Multiple vulnerabilities in Mozilla Thunderbird ESR
Multiple vulnerabilities were found in Mozilla Thunderbird ESR. Malicious users can exploit these vulnerabilities to cause denial of service, bypass security restrictions, execute arbitrary code, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1...
PT-2026-50135
Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description An issue exists in the token public-only scope enforcement where a public-only scoped API token can access private organization data. This occurs due to two flaws: the endpoint '/user/orgs' is...
PT-2026-49924
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware component: Content Server. The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content...
PT-2026-50129
Summary When an application using Pydantic AI opts a URL into force download='allow-local' which disables the default block on private/internal IPs and runs on a network that routes the affected IPv6 transition forms NAT64- or ISATAP-configured networks, the cloud-metadata blocklist could be...
PT-2026-49619
The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'stypes' and 'slocations' parameters of the wppro get overall chart data AJAX action in versions up to, and including, 12.6.8. This is due to the use of stripslashes on user-supplied JSON strings prior to json...
PT-2026-50031
Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Receivables versions 12.2.3 through 12.2.15 Description An issue exists in the Internal Operations component of Oracle Receivables. An unauthenticated attacker with network access via SOAP Simple Object Access...
AlmaLinux 9 : webkit2gtk3 (ALSA-2026:25927)
The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:25927 advisory. webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash CVE-2026-28946 webkitgtk: Processing maliciously crafted web...
PT-2026-50148
Name of the Vulnerable Software and Affected Versions Deno versions prior to 2.8.0 Description The Node.js compatibility TCP path fails to re-verify network permissions after hostname resolution. While the network permission model is intended to apply rules to the resolved IP address, affected...
PT-2026-50139
Name of the Vulnerable Software and Affected Versions Langflow versions prior to 1.9.0 Description The /api/v1/monitor router exposes seven endpoints that allow read, write, and delete operations on user-owned resources, including messages, sessions, build artifacts, and LLM transaction logs. The...
PT-2026-49773
Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.4.23 through 2026.4.23 Description An insecure file permissions issue exists in the config recovery process that restores the OpenClaw.json file with overly broad permissions. Local attackers on shared hosts can exploit...
PT-2026-50170
Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.55 n8n versions prior to 2.25.7 n8n versions prior to 2.26.1 Description An authenticated user with permissions to create or modify workflows and access to a SecurityScorecard credential with limited allowed domains...
PT-2026-49876
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware component: Centralized Third Party Jars. The supported version that is affected is 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence...
Security Bulletin: MongoDB Enterprised Advanced affected by: Improper Authentication, Insertion of Sensitive Information into Log File, Improper Encoding or Escaping of Output (CVE-2026-34500, CVE-2026-34487, CVE-2026-34483)
Summary There are vulnerabilities in tomcat-embed-core-10.1.52.jar used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-34500, CVE-2026-34487, CVE-2026-34483. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-34483 DESCRIPTION: Improper Encoding or Escaping...
CVE-2026-54449
creationtimestamp| type| source ---|---|--- 2026-06-15 21:34:46+00:00| seen| https://bsky.app/profile/undercode.bsky.social/post/3moeag75jqz2p 2026-07-15 18:35:05+00:00| published-proof-of-concept| https://github.com/langbot-app/LangBot/security/advisories/GHSA-3pvh-63gf-j9mw...
EUVD-2026-36992
Unauthenticated Sensitive Data Exposure in Amelia = 2.2 versions...
EUVD-2026-36993
Subscriber Sensitive Data Exposure in WP SMS = 7.2.1 versions...