74316 matches found
CVE-2026-76634 WeGIA < 3.9.2 Insecure Direct Object Reference via profile_funcionario.php
WeGIA before 3.9.2 contains an insecure direct object reference vulnerability in the employee profile page that allows authenticated attackers to access arbitrary employee records by injecting an idpessoa parameter through a request extraction function that overwrites the session-derived...
cve-2026-47849 - HIGH - Spring Data REST allows mutation of identifier and version properties via JSON Patch
cve-2026-47849 - HIGH - Spring Data REST allows mutation of identifier and version properties via JSON Patch...
Authorization Bypass Through User-Controlled Key
Overview org.springframework.data:spring-data-rest-core is a Spring Data REST. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the PATCH process. An attacker can overwrite identifier and version properties by sending crafted RFC 6902 JSON...
CVE-2026-76240
stigmem-node 0.9.0a1 interpolates Postgres backend schema identifiers into SQL strings without defensive quoting. In the affected code path the schema value is operator-controlled, but the unsafe pattern could allow SQL injection if a schema name were derived from tenant, request, or user input...
CVE-2026-76240 stigmem Postgres SQL Injection via Schema Identifier
stigmem-node 0.9.0a1 interpolates Postgres backend schema identifiers into SQL strings without defensive quoting. In the affected code path the schema value is operator-controlled, but the unsafe pattern could allow SQL injection if a schema name were derived from tenant, request, or user input...
CVE-2026-76240
stigmem-node 0.9.0a1 contains a SQL injection vulnerability in its Postgres backend. Schema identifiers are interpolated into SQL strings without defensive quoting. In the affected code path the schema value is operator-controlled, but the unsafe pattern could allow SQL injection if a schema name...
CVE-2026-76240 stigmem Postgres SQL Injection via Schema Identifier
stigmem-node 0.9.0a1 interpolates Postgres backend schema identifiers into SQL strings without defensive quoting. In the affected code path the schema value is operator-controlled, but the unsafe pattern could allow SQL injection if a schema name were derived from tenant, request, or user input...
CGA-6MPM-7C23-FW8V
Bulletin has no description...
BIT-KIBANA-2026-72680 Authorization Bypass Through User-Controlled Key in Kibana Agent Builder Leading to Unauthorized Data Modification
Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a conversation that does not exist and one that exists but belongs to another user. As a result, an...
BIT-ELK-2026-72680 Authorization Bypass Through User-Controlled Key in Kibana Agent Builder Leading to Unauthorized Data Modification
Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a conversation that does not exist and one that exists but belongs to another user. As a result, an...
BIT-ELASTICSEARCH-2026-72687 Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service
A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier. Elasticsearch decodes and deserializes the identifier before confirming that it was legitimately issued by the cluster, and a size value carried inside the...
CVE-2026-70980
creationtimestamp| type| source ---|---|--- 2026-08-19 07:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtga3iytc32e 2026-08-19 16:47:54+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10 2026-08-26 00:37:07+00:00| seen|...
CVE-2026-76344: Path Traversal: 'dir/../../filename'
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could write dispatch metadata to an arbitrary location on the host by supplying a crafted search identifier to a Representational State Transfer REST API endpoint a...
CGA-5796-686X-6CX2
Bulletin has no description...
CVE-2026-61206
creationtimestamp| type| source ---|---|--- 2026-08-18 22:13:42+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtfagrju6l24 2026-08-19 02:20:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtfo7bm2of2b 2026-08-19 17:49:26+00:00| seen|...
CVE-2026-73884
...
CVE-2026-73880
...
CVE-2026-71155
...