72915 matches found
CVE-2026-19243
A security vulnerability has been detected in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool.guardcommand/ExecTool.spawn of the file nanobot/agent/tools/shell.py of the component Shell Allowlist Handler. Such manipulation leads to os command injection. The attack can be executed...
CGA-F6HW-V7QV-59C4
Bulletin has no description...
MINI-8WCW-XR8H-H9WQ
Bulletin has no description...
CVE-2026-15733
creationtimestamp| type| source ---|---|--- 2026-08-07 19:06:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msjat4z4mf2d 2026-08-09 04:14:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msmpvwtkoa2q 2026-08-13 09:00:08+00:00| confirmed|...
CGA-9XMQ-X3Q8-C2R9
Bulletin has no description...
CVE-2025-58375 Frappe has potential SQL Injection due to missing validation
Frappe is a full-stack web application framework. Versions 14.96.9 and below, and 15.0.0 through 15.71.0 have an insecure endpoint parameter that is vulnerable to error-based SQL Injection through lack of validation. Sensitive information such as versioning can be retrieved. This issue is fixed i...
CVE-2026-47361
In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversationid. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ...
CVE-2026-66664
creationtimestamp| type| source ---|---|--- 2026-08-07 18:15:09+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msj5y2ueqz2w...
CVE-2026-47364
In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user-facing opt-out. Impact: The Datadog user UUID and crash data are visible within Firebase Crashlytics. This UUID is not identifying outside Datadog's own...
CVE-2026-47361
In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversationid. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ...
CVE-2026-47361
Datadog’s Android app exposes BubbleChatActivity (android:exported="true") with no permission guard, accepts SEND intents with mimeType text/plain, and reads a conversation_id from extras. On destruction, BubbleChatNotification.dismiss unconditionally cancels a hard-coded Bits AI notification (ID...
CVE-2026-66711
creationtimestamp| type| source ---|---|--- 2026-08-07 17:15:10+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msj2mshy3p2w...
GHSA-7C4V-FWGW-9RF7 Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint
Impact When a Nuxt dev server is bound to a network-reachable interface for example nuxt dev --host for on-device testing, the default-enabled Chrome DevTools workspace endpoint GET /.well-known/appspecific/com.chrome.devtools.json returns the absolute project root workspace.root, i.e. rootDir an...
CVE-2026-17601
A user holding a permission to update privilege definitions could modify a wildcard privilege already assigned to their own role to grant broader permissions than they were authorized to hold, including full administrative access, without any additional authorization check or role reassignment...
GHSA-WG23-69C2-GJC8
creationtimestamp| type| source ---|---|--- 2026-08-07 15:31:58+00:00| seen| https://gist.github.com/alon710/1c07f05a9611684f7f4ae2d0d6c93c3e...
CVE-2026-19264
creationtimestamp| type| source ---|---|--- 2026-08-07 15:02:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msit6t2ljn26 2026-08-07 16:20:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/675k6a4kh2ptu 2026-08-12 08:00:05+00:00| seen|...
GHSA-JFM3-95JQ-Q3RF
creationtimestamp| type| source ---|---|--- 2026-08-07 14:32:36+00:00| seen| https://gist.github.com/alon710/083e0c15dfeb9a6ae7deb8244b73b528...
ECHO-3FAE-029D-C3D0
Bulletin has no description...