58253 matches found
CVE-2026-53283 iommu/amd: Bounds-check devid in __rlookup_amd_iommu()
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Bounds-check devid in rlookupamdiommu iommudeviceregister walks every device on the PCI bus via busforeachdev and calls amdiommuprobedevice for each. The inlined checkdevice path computes the device's sbdf, calls...
CVE-2026-44732 OpenProject: IDOR on OpenProject through /api/v3/documents/{id} via PATCH parameter "project_id" leads to Unauthorized Modification of Resources
OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, OpenProject exposes a document update endpoint used to modify existing documents. The target document is loaded with visibility checks and then updated. During update, attacker-controlled attributes are...
CVE-2026-44732 OpenProject: IDOR on OpenProject through /api/v3/documents/{id} via PATCH parameter "project_id" leads to Unauthorized Modification of Resources
OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, OpenProject exposes a document update endpoint used to modify existing documents. The target document is loaded with visibility checks and then updated. During update, attacker-controlled attributes are...
CVE-2026-52782 OpenProject: IDOR through /projects/<A>/settings/project_storages/<A_ps_id> via PATCH parameter "storages_project_storage[project_folder_id]" leads to Access to Unauthorized Resources
OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is an IDOR through /projects//settings/projectstorages/ via PATCH parameter "storagesprojectstorageprojectfolderid" leads to Access to Unauthorized Resources. A project-admin in one project can...
CVE-2026-52784 OpenProject: CSRF on TARGET through /users/:id via POST parameter "user[admin]"
OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is a CSRF on TARGET through /users/:id via POST parameter "useradmin". This vulnerability is fixed in 17.3.3 and 17.4.1...
CVE-2026-52784
CVE-2026-52784 (OpenProject) is a CSRF vulnerability in OpenProject’s web UI. The issue allows CSRF on a user-targeted action via POST to /users/:id with the parameter user[admin], enabling unauthorized state changes without user interaction. Affected software versions are prior to 17.3.3 and 17....
External Control of File Name or Path
Overview Affected versions of this package are vulnerable to External Control of File Name or Path via unsanitized handling of the uploadId parameter in the multipart upload process. An attacker can create arbitrary files on the host system, potentially leading to arbitrary command execution, by...
External Control of File Name or Path
Overview Affected versions of this package are vulnerable to External Control of File Name or Path via unsanitized handling of the uploadId parameter in the multipart upload process. An attacker can create arbitrary files on the host system, potentially leading to arbitrary command execution, by...
CGA-97JR-54H6-QWPW
Bulletin has no description...
CVE-2026-57642
creationtimestamp| type| source ---|---|--- 2026-06-26 17:17:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp7h5s5m7g27 2026-07-06 07:15:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpxk6fmbje24...
CVE-2026-56823
AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to , the POST /api/integrations/webhooks/webhookid/ping endpoint fetches the target webhook by primary key alone without verifying that the webhook belongs to the...
GHSA-PX7Q-GGQJ-HCF2
creationtimestamp| type| source ---|---|--- 2026-06-26 16:42:20+00:00| seen| https://gist.github.com/alon710/8649cee74b41dfbab6352036ad771ea3 2026-06-26 16:52:45+00:00| seen| https://gist.github.com/alon710/ab6fb045bc60bbc32d947423444fcf91...
CVE-2026-45256
When used to deliver a signal to a specific thread, thrkill22 called pcansignal to determine whether the operation was permitted but did not check the result before delivering the signal. The signal was sent even when the permission check failed. The system call returned the resulting error to th...
CGA-V3W7-3995-RC8X
Bulletin has no description...
CVE-2026-57588
creationtimestamp| type| source ---|---|--- 2026-06-26 14:40:15+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mp76f4d3ur2c 2026-07-22 17:00:04+00:00| seen| Telegram/WRVd5yOWBdxKpqesnEO3eRKAwr-Rlmtkgf90pSpwV55ICCw 2026-07-23 00:00:09+00:00| published-proof-of-concept|...
CVE-2026-57200
creationtimestamp| type| source ---|---|--- 2026-06-26 14:40:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mp76evoqrj2e...
MAL-2026-6521 Malicious code in @carvana.authentication-flows/shared (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78538bf70d1ebd3e4cd784d90b3961ea7966ce9b97e8124110374cad95c0b894 package.json declares a preinstall hook node index.js that runs unconditionally on npm install. index.js imports childprocess/os/https, collects host...
CVE-2026-57940
creationtimestamp| type| source ---|---|--- 2026-06-26 13:55:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp73v5vpvq2l...
