53608 matches found
PT-2026-76690
New API is a large language mode LLM gateway and artificial intelligence AI asset management system. From 0.9.1.3 until 1.0.0-rc.7, AdminResetPasskey in controller/passkey.go lacks the canManageTargetRole authorization check for DELETE /api/user/:id/reset passkey, allowing a lower-privileged...
PT-2026-76735
Name of the Vulnerable Software and Affected Versions sqlparse versions prior to 0.6.0 Description sqlparse contains a Regular Expression Denial of Service ReDoS issue where the lexer repeatedly scans unmatched dollar-quoted literals and multiline-comment delimiters. This occurs because the regex...
PT-2026-73288
Ghost is a Node.js content management system. From 4.9.0 until 6.54.1, an input validation issue allowed any staff user to create a post with content in feature image caption that could be used to hijack another staff user's Ghost Admin session, resulting in privilege escalation. This issue is...
PT-2026-76823
Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.300, a connected peer can send repeated DCLP DataChunk messages to ClipboardChunk::assemble in src/lib/deskflow/ClipboardChunk.cpp, causing the server path in src/lib/server/ClientProxy1 6.cpp or client path i...
PT-2026-76866
Name of the Vulnerable Software and Affected Versions Onyx versions prior to 3.1.10 Onyx versions prior to 3.2.14 Onyx versions prior to 4.0.0 Description An issue exists where the 'GET /api/mcp/servers' and 'GET /api/mcp/servers/persona/persona id' endpoints expose the OAuth Authorization header...
PT-2026-76724
Name of the Vulnerable Software and Affected Versions Glances versions prior to 4.5.6 Description An issue exists in the as dict secure function within glances/config.py where the sanitization process only validates option names against a regex pattern and fails to inspect the actual values. This...
PT-2026-73142
OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, versions, and backend configurations. As a result, values marked as sensitive may be exposed through these configuration elements instead o...
AZL-96111 CVE-2026-74458 affecting package kernel 6.6.150.1-1
In the Linux kernel, the following vulnerability has been resolved: can: kvaserusbleaf: kvaserusbleafwaitcmd: validate received command extents The wait and bulk receive paths walk variable-length commands from a USB buffer. A nonzero command shorter than CMDHEADERLEN can still be dispatched, and...
EUVD-2026-59604
Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches...
CVE-2026-74278
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix kernel heap address leak in bounceerrorevent The comment above bounceerrorevent documents that user clients should receive SNDRVSEQEVENTBOUNCE with the original event embedded as variable-length data, while kernel...
PT-2026-76445
These are all security issues fixed in the kubeshark-cli-53.4.0-1.1 package on the GA media of openSUSE Tumbleweed...
PT-2026-76439
These are all security issues fixed in the cargo-c-0.10.23-2.1 package on the GA media of openSUSE Tumbleweed...
CVE-2026-50027
CVE-2026-50027 describes a missing authentication flaw in mcp-memory-service where all HTTP routes under /api/documents/* are accessible without credentials prior to version 10.67.1. An unauthenticated attacker can perform write, read, and delete operations on stored memories, bypassing the inten...
CVE-2026-73845
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the ckangetmqaquality and ckangetmqaqualitydetails tools in src/tools/quality.ts use isValidMqaServer to validate the serverurl parameter with a prefix-only regular expression for dati.gov.it, allowing suffix-host an...
ROOT-APP-PYPI-CVE-2026-41314 CVE-2026-41314 in pypdf - Patched by Root
Root has patched CVE-2026-41314 in the pypdf package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-41313 CVE-2026-41313 in pypdf - Patched by Root
Root has patched CVE-2026-41313 in the pypdf package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-GHSA-4PXV-J86V-MHCW GHSA-4pxv-j86v-mhcw in pypdf - Patched by Root
Root has patched GHSA-4pxv-j86v-mhcw in the pypdf package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-GHSA-X284-J5P8-9C5P GHSA-x284-j5p8-9c5p in pypdf - Patched by Root
Root has patched GHSA-x284-j5p8-9c5p in the pypdf package for Root:PyPI. Multiple fixed versions available...