72047 matches found
GHSA-XG37-CJ68-XWQ6 vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-QWX8-W8WW-92JG vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-H95Q-CHXX-CXJM vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-W538-WWCV-92WW vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-XFQ5-GFCH-M94W vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2026-17736 vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2026-17874 vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2026-17820 vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2026-17719 vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2026-17714 vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2026-17980 vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2026-17656 vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2026-68746
Not Failing Securely 'Failing Open' vulnerability in livebook-dev livebook allows an unauthenticated network client to obtain full access to a Livebook server that enforces identity through Livebook Teams. A Livebook Agent or App Server connected to Livebook Teams caches the identifier of the...
rclone local `--metadata` applies attacker-controlled mode/uid - setuid binary planted from an untrusted remote
Summary When writing an object with metadata, the local backend applies the source-supplied mode, uid, and gid verbatim: it parses mode as an octal integer and passes it straight into os.Chmodo.path, os.FileModeumode, and passes uid/gid straight into os.Chown. The value is never masked to...
CVE-2026-68746 Livebook Teams identity check fails open when the deployment group is unresolvable, allowing unauthenticated access
Not Failing Securely 'Failing Open' vulnerability in livebook-dev livebook allows an unauthenticated network client to obtain full access to a Livebook server that enforces identity through Livebook Teams. A Livebook Agent or App Server connected to Livebook Teams caches the identifier of the...
CVE-2026-70616
CVE-2026-70616 affects boringproxy 0.10.0. The vulnerability allows an authenticated user to cause resource exhaustion on the server by sending requests to GET /loading with attacker-supplied id values. The handler performs no map-lookup validation and blocks on a nil channel, with no timeout, ca...
CVE-2026-20310
creationtimestamp| type| source ---|---|--- 2026-08-05 17:24:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mse26wvyiq2o 2026-08-05 18:07:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/czdl4fbd4szpo 2026-08-06 08:01:07+00:00| seen|...
jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...
jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...