25986 matches found
CVE-2026-70557: Authorization Bypass Through User-Controlled Key
diboot-core's POST /common/load-related-data endpoint resolves caller-supplied field names to any @TableField column of any entity and returns those values for all rows, with no field or entity allowlist. The only guard, relatedDataSecurityCheck, returns true unconditionally, so any authenticated...
CVE-2026-67689
A SQL Injection vulnerability exists in FineAdmin V1.0 (specifically in FineAdmin.Mvc ) due to improper neutralization of special elements in SQL commands. The BaseService.GetListByFilter() and GetPageUnite() methods directly concatenate the field and order parameters into the ORDER BY clause usi...
CVE-2026-19024 HDF5 H5Pget_fill_value NULL Pointer Dereference via Malformed Fill Value Message
NULL pointer dereference in H5Pgetfillvalue in HDF5 before 2.3.0 allows attackers to cause a denial of service via a dataset whose version 1 or 2 fill value message has the "defined" flag set together with a negative size field, which is not normalized to the library's "undefined" sentinel and...
CVE-2026-10716
Directus contains an authenticated SQL injection vulnerability in the collection creation flow when the instance uses PostgreSQL with PostGIS enabled. An administrator can create a collection with a geometry field whose fields.type value starts with geometry but contains attacker-controlled SQL...
DRUPAL-CONTRIB-2026-093
This module provides formatters to allow in-place editing in a View or other display full content, teaser.... The module doesn't sufficiently check access when editing entities. A malicious user could craft requests to allow them to modify any field on any entity. This vulnerability is mitigated ...
CVE-2026-10716
Directus contains an authenticated SQL injection vulnerability in the collection creation flow when the instance uses PostgreSQL with PostGIS enabled. An administrator can create a collection with a geometry field whose fields.type value starts with geometry but contains attacker-controlled SQL...
EUVD-2026-53519
Directus contains an authenticated SQL injection vulnerability in the collection creation flow when the instance uses PostgreSQL with PostGIS enabled. An administrator can create a collection with a geometry field whose fields.type value starts with geometry but contains attacker-controlled SQL...
CVE-2026-10716 Directus <12.1.0 - Authenticated time-based SQL injection in PostgreSQL/PostGIS collection creation
Directus contains an authenticated SQL injection vulnerability in the collection creation flow when the instance uses PostgreSQL with PostGIS enabled. An administrator can create a collection with a geometry field whose fields.type value starts with geometry but contains attacker-controlled SQL...
CVE-2026-17623
IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation of the command field in MCP server configurations...
EUVD-2026-53478
IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation of the command field in MCP server configurations...
SUSE-SU-2026:3503-1 Security update for python-Django
This update for python-Django fixes the following issues: - CVE-2026-15307: server-side file-write and request forgery via spatial lookups bsc1272997. - CVE-2026-15337: potential denial-of-service vulnerability in checkforlanguage bsc1272998. - CVE-2026-15830: potential denial-of-service...
Security update for python-Django
This update for python-Django fixes the following issues: CVE-2026-15307: server-side file-write and request forgery via spatial lookups bsc1272997. CVE-2026-15337: potential denial-of-service vulnerability in checkforlanguage bsc1272998. CVE-2026-15830: potential denial-of-service vulnerability...
CVE-2026-71291 Bolt CMS Server-Side Template Injection via Unsandboxed allow_twig Field Rendering
Bolt CMS renders content field values through Twig's full application-level Environment with no SandboxExtension registered anywhere in the codebase. In src/Entity/Field.php, getTwigValue calls shouldBeRenderedAsTwig, which gates rendering only on the field definition's allowtwig flag and a regex...
EUVD-2026-53352
microtar's mtarwritefileheader and mtarwritedirheader functions src/microtar.c copy a caller-supplied entry name into the 100-byte name field of a stack-allocated mtarheadert via strcpyh.name, name, with no check that strlenname is less than 100 before the copy. Any application that calls these...
CVE-2026-71260
ESPHome through 2026.7.0-dev discloses plaintext passwords via its webserver component. In WebServer::textjson esphome/components/webserver/webserver.cpp, a text entity configured with mode: password TEXTMODEPASSWORD has its JSON "state" field correctly masked as "", but the same serialization pa...
CVE-2026-71260 ESPHome web_server Plaintext Password Disclosure via JSON "value" Field
ESPHome through 2026.7.0-dev discloses plaintext passwords via its webserver component. In WebServer::textjson esphome/components/webserver/webserver.cpp, a text entity configured with mode: password TEXTMODEPASSWORD has its JSON "state" field correctly masked as "", but the same serialization pa...
CVE-2026-71260 ESPHome web_server Plaintext Password Disclosure via JSON "value" Field
ESPHome through 2026.7.0-dev discloses plaintext passwords via its webserver component. In WebServer::textjson esphome/components/webserver/webserver.cpp, a text entity configured with mode: password TEXTMODEPASSWORD has its JSON "state" field correctly masked as "", but the same serialization pa...
CVE-2026-71260
CVE-2026-71260 affects ESPHome up to 2026.7.0-dev. In the web_server component, a text entity with mode: password correctly masks the TEXT field in the JSON 'state', but the serialization path unconditionally writes the raw password into the JSON 'value' field via set_json_icon_state_value()/set_...
CVE-2026-66748-Camaleon-CMS---Authenticated-RCE-via-select_eval-Custom-Field — Updated!
Security Advisory: Camaleon CMS - Authenticated RCE via selecteval Custom Field Assigned CVE ID: CVE-2026-66748 Product: Camaleon CMS https://github.com/owen2345/camaleon-cms Affected versions: 2.1.1 – 2.9.1 introduced commit 415cbda6 2015-10-16; fixed commit 15882366 2026-03-29 / v2.9.2 Severity...