72893 matches found
PT-2026-89544
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Ruby Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...
GHSA-7JX3-JQCP-HHGC vulnerabilities
Vulnerabilities for packages: mlflow, checkov...
CVE-2026-87853
A flaw was found in SSSD's IdP authentication provider. The evalaccesstokenbuf function compares the OIDC subject identifier using strncmp with the authenticated user's identifier length, performing a prefix comparison instead of an exact match. An attacker whose IdP identifier is a strict prefix...
DEBIAN-CVE-2026-87853
A flaw was found in SSSD's IdP authentication provider. The evalaccesstokenbuf function compares the OIDC subject identifier using strncmp with the authenticated user's identifier length, performing a prefix comparison instead of an exact match. An attacker whose IdP identifier is a strict prefix...
CVE-2026-87853 Sssd: sssd: idp authentication prefix comparison allows cross-user impersonation
A flaw was found in SSSD's IdP authentication provider. The evalaccesstokenbuf function compares the OIDC subject identifier using strncmp with the authenticated user's identifier length, performing a prefix comparison instead of an exact match. An attacker whose IdP identifier is a strict prefix...
EUVD-2026-74769
Use of less trusted source vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API v9x WHMCS Module allows Exploitation of Trusted Identifiers. This issue affects PayTR Virtual Pos iFrame API v9x WHMCS Module: from v9.0.0 before v9.0.3...
CVE-2026-57825
In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files...
ROOT-OS-DEBIAN-12-CVE-2026-46086 CVE-2026-46086 in linux - Patched by Root
Root has patched CVE-2026-46086 in the linux package for Root:Debian:12. Multiple fixed versions available...
ROOT-OS-DEBIAN-12-CVE-2025-38349 CVE-2025-38349 in linux - Patched by Root
Root has patched CVE-2025-38349 in the linux package for Root:Debian:12. Multiple fixed versions available...
ROOT-OS-DEBIAN-12-CVE-2025-68369 CVE-2025-68369 in linux - Patched by Root
Root has patched CVE-2025-68369 in the linux package for Root:Debian:12. Multiple fixed versions available...
ROOT-OS-DEBIAN-12-CVE-2026-46301 CVE-2026-46301 in linux - Patched by Root
Root has patched CVE-2026-46301 in the linux package for Root:Debian:12. Multiple fixed versions available...
ROOT-OS-DEBIAN-12-CVE-2024-56742 CVE-2024-56742 in linux - Patched by Root
Root has patched CVE-2024-56742 in the linux package for Root:Debian:12. Multiple fixed versions available...
ROOT-OS-DEBIAN-12-CVE-2025-40164 CVE-2025-40164 in linux - Patched by Root
Root has patched CVE-2025-40164 in the linux package for Root:Debian:12. Multiple fixed versions available...
ROOT-OS-DEBIAN-12-CVE-2025-37850 CVE-2025-37850 in linux - Patched by Root
Root has patched CVE-2025-37850 in the linux package for Root:Debian:12. Multiple fixed versions available...
CVE-2026-86079 n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Elasticsearch and ElasticSecurity nodes interpolated workflow-controlled index and document identifiers directly into REST request paths. An identifier containing path separators or dot segments could...
CVE-2026-62646
A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. A session identifier is generated using an algorithm with insufficient randomness, resulting in a token with low entropy that can be predicted or brute-forced within a feasible number of attempts. This could allow an...
CVE-2026-62647
A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. A random number generator is used to generate security-relevant values such as session identifiers used for authentication purposes that is not initialized with a True Random Number Generator TRNG, resulting in a predictable...
CVE-2026-62646
CVE-2026-62646 affects Reyrolle 7SR5 (all versions prior to V2.70 ), a Siemens industrial communication gateway. The vulnerability resides in the session identifier generation mechanism: an algorithm with insufficient randomness produces low-entropy tokens that can be predicted or brute-forced. A...
CVE-2026-75816 Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the preupdatevalue function lacking any capability or ownership check, and ActionPost::conditionslogic short-circuiting it...