75347 matches found
MINI-8FGG-Q3XP-CV52
Bulletin has no description...
PT-2026-57631
The User Registration & Membership WordPress plugin before 5.2.2 does not perform an authorization check on a membership-upgrade action and derives the user to modify from a caller-supplied identifier instead of the current user, allowing any authenticated user such as a subscriber to change...
PT-2026-57804
Mattermost versions 11.7.x = 11.7.1, 11.6.x = 11.6.4, 10.11.x = 10.11.19 fail to restrict metric configuration changes to the playbook being saved, which allows an authenticated user with team access to alter another user’s playbook metric settings via a crafted import or update request with a...
PT-2026-59575
Summary The MultiAgentLedger and MultiAgentMonitor components in the provided code exhibit vulnerabilities that can lead to context leakage and arbitrary file operations. Specifically: 1. Memory State Leakage via Agent ID Collision: The MultiAgentLedger uses a dictionary to store ledgers by agent...
PT-2026-57918
Name of the Vulnerable Software and Affected Versions Crypt::OpenSSL::X509 versions prior to 2.1.3 Description A heap out-of-bounds read exists in hv exts when processing a long certificate extension OID Object Identifier. When building the extension hash through the functions extensions,...
Linux Distros Unpatched Vulnerability : CVE-2026-58052
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - 7-Zip for Windows through 26.01 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppresses an...
MiracleLinux 8 : edk2-20220126gitbb1bba3d77-13.el8_10.10 (AXSA:2026-1248:03)
The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1248:03 advisory. openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap CVE-2025-9230 Bug Fixes and Enhancements: FJ8.10 Bug How to Update Secure Boot Certificates with...
PT-2026-57819
Name of the Vulnerable Software and Affected Versions Skillable affected versions not specified Description A flaw in the lab platform allows for the forgery of a client-supplied identifier to bypass per-user lab launch limits. By modifying the userId variable provided by the browser, an attacker...
PT-2026-59364
Summary Open WebUI has a Broken Object Level Authorization BOLA vulnerability in the builtin search knowledge files tool. When native function calling is enabled and the selected model has no attached knowledge bases, an authenticated user can call search knowledge files with an arbitrary knowled...
PT-2026-59951
Impact The UnbatchGradOp function takes an argument id that is assumed to be a scalar. A nonscalar id can trigger a CHECK failure and crash the program. python import numpy as np import tensorflow as tf id is not scalar tf.raw ops.UnbatchGradoriginal input= tf.constant1,batch index=tf.constant0,0...
PT-2026-57908
Name of the Vulnerable Software and Affected Versions SourceCodester Class and Exam Timetabling System version 1.0 Description A SQL injection flaw exists in the /edit exam2.php endpoint. This issue occurs when the ID argument is manipulated, allowing a remote attacker to execute arbitrary SQL...
PT-2026-59368
Summary Any user X can continue the conversation of any other user Y, as long as the Chat ID of Y is known. User X does not even need to be an admin to do so. Details A user just needs to use the API endpoint: /api/chat/completions with their own API key generated in OWUI and the Chat ID of anoth...
PT-2026-59397
Mass Assignment in Feedback Creation Allows User ID Spoofing and Evaluation Data Manipulation Summary The POST /api/v1/evaluations/feedback endpoint in Open WebUI v0.9.2 is vulnerable to mass assignment via FeedbackForm, which uses model config = ConfigDictextra='allow'. Due to an insecure...
PT-2026-59286
A vulnerability was found in mem0ai mem0 up to 1.0.11. This affects the function pickle.load/pickle.dump of the file mem0/vector stores/faiss.py. Performing a manipulation results in deserialization. It is possible to initiate the attack remotely. The exploit has been made public and could be use...
PT-2026-57821
Name of the Vulnerable Software and Affected Versions apache-airflow-providers-fab versions prior to 3.7.2 Description In the Apache Airflow FAB auth manager, a privilege escalation occurs when a DAG is created with a dag id of DAGs. This specific ID collides with the global all-DAGs permission...
PT-2026-59590
A vulnerability has been found in PrefectHQ prefect up to 3.6.28.dev1. Affected by this vulnerability is the function validate restricted url of the component Webhook/Notification. The manipulation leads to time-of-check time-of-use. It is possible to initiate the attack remotely. The attack is...
PT-2026-59408
Summary The API /api/v1/notes/note id endpoint lacks proper authorization checks, allowing authenticated users to retrieve notes belonging to other users by guessing or enumerating UUIDs. This results in unauthorized disclosure of potentially sensitive or private user data. Details - if notes is...
MINI-38PV-3JR6-JJC6
Bulletin has no description...
CVE-2026-15508
creationtimestamp| type| source ---|---|--- 2026-07-12 23:29:34+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqidge2kbd2x 2026-07-12 23:37:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqiduo2m3q2t 2026-07-13 03:15:03+00:00| seen|...