74312 matches found
CVE-2026-84702 facefusion before 3.7.0 Path Traversal via Job Identifier
facefusion through 3.6.1 fails to normalize job identifiers in getjobfilename, allowing attackers to write files outside the jobs directory. Attackers can supply traversal sequences in the job identifier parameter through the unauthenticated HTTP API to create files at arbitrary locations...
PT-2026-84606
The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users' reservations. This is an...
CVE-2026-78584: Observable Response Discrepancy
Observable Response Discrepancy CWE-204 in the Kibana Osquery feature can lead to information disclosure via Query System for Information CAPEC-54. An authenticated user holding Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are no...
PT-2026-84605
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token before running the post-booking action chain, allowing an unauthenticated user to trigger booking notifications and integration callbacks for a booking by...
PT-2026-84581
facefusion through 3.6.1 fails to normalize job identifiers in get job file name, allowing attackers to write files outside the jobs directory. Attackers can supply traversal sequences in the job identifier parameter through the unauthenticated HTTP API to create files at arbitrary locations...
GHSA-VCC3-GHJQ-M6FR vulnerabilities
Vulnerabilities for packages: dotstatsuite-supercore, opensearch-dashboards-fips, vitess, kubeflow-pipelines, kibana, wazuh-dashboard, gitlab-rails-ce-fips, nextcloud-server, gitlab-rails-ce, sqlpad, wazuh-dashboard-fips, opensearch-dashboards...
EUVD-2026-69250
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true...
CLEANSTART-2026-JJ72716 Security fixes in kubernetes-event-exporter 1.6.1-r1
Package kubernetes-event-exporter version 1.6.1-r1 fixes 1 vulnerabilities: ghsa-hrxh-6v49-42gf...
CLEANSTART-2026-RU71621 Security fixes in grafana 12.4.7-r1
Package grafana version 12.4.7-r1 fixes 10 vulnerabilities: ghsa-r277-6w6q-xmqw, ghsa-jpcw-4wr7-c3vq, ghsa-gcjh-h69q-9w9g, CVE-2026-21728, CVE-2026-28377...
CVE-2026-81523
A flaw was found in libmongocrypt. A missing input validation vulnerability in the automatic-encryption context setup allows a caller-supplied database identifier to be accepted without proper sanitization. This can lead to incorrect schema selection, potentially resulting in limited disclosure o...
CGA-8GMJ-85G4-HV76
Bulletin has no description...
MINI-V4W6-R46G-FCR3
Bulletin has no description...
CGA-3R3Q-32PX-J86Q
Bulletin has no description...
MINI-52JM-42FP-V64P
Bulletin has no description...
MINI-XGQC-QCJM-Q4WR
Bulletin has no description...
MINI-W987-6VPF-82Q8
Bulletin has no description...
CVE-2026-83492
creationtimestamp| type| source ---|---|--- 2026-08-31 16:51:36+00:00| seen| https://infosec.exchange/users/AAKL/statuses/117191153821162421...
BIT-KIBANA-2026-78581 Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Data Modification in Kibana
Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier t...