58853 matches found
CVE-2026-34759
OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, multiple notification API endpoints are registered without authentication middleware, while sibling endpoints in the same codebase correctly use ClusterKeyAuthorization.isAuthorizedServiceMiddleware. Thes...
CVE-2026-33175
creationtimestamp| type| source ---|---|--- 2026-04-03 23:01:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mimt7hbnhq2o 2026-04-03 23:21:37+00:00| published-proof-of-concept| Telegram/CEl2HN4MrzqJMXyxgw87k5eg4RsD4Gdp10Ib2zQOK7Dk 2026-04-04 03:02:44+00:00| seen|...
CVE-2026-34934 PraisonAI: Second-Order SQL Injection in `get_all_user_threads`
PraisonAI is a multi-agent teams system. Prior to version 4.5.90, the getalluserthreads function constructs raw SQL queries using f-strings with unescaped thread IDs fetched from the database. An attacker stores a malicious thread ID via updatethread. When the application loads the thread list, t...
CVE-2026-23425
A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine for ARM64 architectures. This vulnerability arises from improper initialization of ID registers for non-protected pKVM protected KVM guests. A malicious guest operating system could exploit this by causing the hypervisor, the...
LiteLLM: Authentication bypass via OIDC userinfo cache key collision
Impact When JWT authentication is enabled enablejwtauth: true, the OIDC userinfo cache uses token:20 as the cache key. JWT headers produced by the same signing algorithm generate identical first 20 characters. This configuration option is not enabled by default. Most instances are not affected. A...
CVE-2026-27456 util-linux: TOCTOU Race Condition in util-linux mount(8) - Loop Device Setup
util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU Time-of-Check-Time-of-Use vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privilege...
CVE-2026-25197
A specific endpoint allows authenticated users to pivot to other user profiles by modifying the id number in the API call...
CVE-2026-25197
A specific endpoint allows authenticated users to pivot to other user profiles by modifying the id number in the API call...
CVE-2026-25197
CVE-2026-25197 pertains to Gardyn Cloud API, where an endpoint allows an authenticated user to pivot to other user profiles by altering the id parameter in the API call. The underlying issue is an authorization bypass via a user-controlled key/id, enabling access to other profiles and potentially...
CVE-2026-25726
Cloudreve is a self-hosted file management and sharing system. Prior to version 4.13.0, the application uses the weak pseudo-random number generator math/rand seeded with time.Now.UnixNano to generate critical security secrets, including the secretkey, and hashidsalt. These secrets are generated...
EUVD-2026-18653
UNSUPPORTED WHEN ASSIGNED Focalboard version 8.0 fails to validate file ownership when serving uploaded files. This allows an authenticated attacker who knows a victim's fileID to read the content of the file. NOTE: Focalboard as a standalone product is not maintained and no fix will be issued...
EUVD-2026-18647
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix ID register initialization for non-protected pKVM guests In protected mode, the hypervisor maintains a separate instance of the kvm structure for each VM. For non-protected VMs, this structure is initialized from...
GHSA-GHC5-95C2-VWCV
creationtimestamp| type| source ---|---|--- 2026-04-03 15:22:05+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3milzkcnizop2 2026-04-03 16:52:24+00:00| seen|...
CVE-2026-23425
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix ID register initialization for non-protected pKVM guests In protected mode, the hypervisor maintains a separate instance of the kvm structure for each VM. For non-protected VMs, this structure is initialized from...
CVE-2026-23422
In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: Fix interrupt storm after receiving bad ifid in IRQ handler Commit 31a7a0bbeb00 "dpaa2-switch: add bounds check for ifid in IRQ handler" introduces a range check for ifid to avoid an out-of-bounds access. If an...
CVE-2026-23425
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix ID register initialization for non-protected pKVM guests In protected mode, the hypervisor maintains a separate instance of the kvm structure for each VM. For non-protected VMs, this structure is initialized from...
UBUNTU-CVE-2026-23422
In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: Fix interrupt storm after receiving bad ifid in IRQ handler Commit 31a7a0bbeb00 "dpaa2-switch: add bounds check for ifid in IRQ handler" introduces a range check for ifid to avoid an out-of-bounds access. If an...
UBUNTU-CVE-2026-23425
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix ID register initialization for non-protected pKVM guests In protected mode, the hypervisor maintains a separate instance of the kvm structure for each VM. For non-protected VMs, this structure is initialized from...
CVE-2026-34217
creationtimestamp| type| source ---|---|--- 2026-04-03 14:07:54+00:00| published-proof-of-concept| https://github.com/nyariv/SandboxJS/security/advisories/GHSA-hg73-4w7g-q96w 2026-04-09 19:22:33+00:00| seen| Telegram/HFSRmPQIuJm0mhlgKTjgnUZc9IKWtHrGIbUWbiDZawdQwcQ 2026-04-11 09:34:25+00:00| seen|...
CVE-2026-23425 KVM: arm64: Fix ID register initialization for non-protected pKVM guests
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix ID register initialization for non-protected pKVM guests In protected mode, the hypervisor maintains a separate instance of the kvm structure for each VM. For non-protected VMs, this structure is initialized from...