MINI-P4Q5-632F-VXWC

Bulletin has no description...

MINI-3J3F-H7VC-96C3

Bulletin has no description...

MINI-W297-4HQR-892Q

Bulletin has no description...

MINI-JM9C-8Q57-F33G

Bulletin has no description...

MINI-5J4Q-XCCP-5CMG

Bulletin has no description...

MINI-JC9G-PP45-Q5Q2

Bulletin has no description...

MINI-2RRQ-28P4-9V8W

Bulletin has no description...

GHSA-33G4-646G-QWMM Snipe-IT has Multi-Tenancy Bypass via Bulk Asset Update

Impact The BulkAssetsController::update method accepts companyid directly from user input without calling Company::getIdForCurrentUser, the standard company-scoping function used by every other controller in the codebase. A non-superadmin user can move assets across company boundaries, breaking...

GHSA-8C6H-7G6X-M5X4

creationtimestamp| type| source ---|---|--- 2026-06-23 22:42:14+00:00| seen| https://gist.github.com/alon710/b22b0dd984dd927be769bc999880e7f3...

UBUNTU-CVE-2026-54512

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator PTV is the primary safety mechanism guarding polymorphic deserialization. When polymorphic...

EUVD-2026-38595

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator PTV is the primary safety mechanism guarding polymorphic deserialization. When polymorphic...

CVE-2026-56120

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it's a duplicate of CVE-2026-56784...

CVE-2026-47279

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the public shared-view relation endpoints accepted a caller-supplied column ID without verifying that the column was visible in the shared view, so anyone holding a share UUID could read links from any LTAR column on t...

CVE-2026-54319

creationtimestamp| type| source ---|---|--- 2026-06-23 20:09:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moy7frrskd24...

CVE-2026-54320

creationtimestamp| type| source ---|---|--- 2026-06-23 20:08:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moy7cs26fp2f...

Cross-site Scripting (XSS)

Overview @n8n/n8n-nodes-langchain is a Affected versions of this package are vulnerable to Cross-site Scripting XSS via the webhookId parameter in the Chat Trigger node. An attacker can execute arbitrary JavaScript in the context of another user's session by injecting malicious code, which is the...

CVE-2026-54019

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI added collection-level ACL checks, but the patch can still be bypassed when Milvus multitenancy mode is enabled. The ACL allows unknown non-KB collection names as...

EUVD-2026-38563

Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.185.0, Daytona's organization role update and delete endpoints authorized the caller as an owner of the organization named in the request path, but resolved and mutated the targe...

CVE-2026-54322 Daytona: Cross-org IDOR in organization role update/delete — any org owner can rewrite or destroy another org's roles

Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.185.0, Daytona's organization role update and delete endpoints authorized the caller as an owner of the organization named in the request path, but resolved and mutated the targe...

CVE-2026-54015 Open WebUI: Prompt history IDOR: unbound history_id allows cross-prompt read and deletion

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI's prompt version-history endpoints authorize the promptid in the URL but then act on caller-supplied history IDs without verifying that the history row belongs to that...