72392 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-8461
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be...
CGA-V43F-5GF4-32GG
Bulletin has no description...
CVE-2026-48584
creationtimestamp| type| source ---|---|--- 2026-06-19 22:31:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moofhtv2b42q 2026-06-22 00:36:50+00:00| seen| https://bsky.app/profile/securitycyberuk.bsky.social/post/3motnfcrouu2v 2026-06-22 09:01:14+00:00| seen|...
Directory Traversal
Overview everos is an EverOS — local-first markdown memory framework for AI agents and user chats; lightweight, dev-friendly, small-team Affected versions of this package are vulnerable to Directory Traversal via the senderid field in the POST /api/v1/memory/add endpoint. An attacker can create o...
Network-AI: EnvironmentManager.restore() backup ID path traversal copies arbitrary directories into environment data
Summary EnvironmentManager.restoreenv, backupId computes the backup path with joinenvDir, '.backups', backupId and only checks that this path exists. It does not resolve the result or verify that it remains under data//.backups. A caller can pass a traversal backup ID such as...
GHSA-QWQC-P3Q8-WCG9 Langflow: Unauthenticated DoS through multipart form boundary file upload
Summary An attacker can send a /api/v1/files/upload/ request without any authentication token/cookies and abuse a very long multipart form boundary to make the langflow app unusable for all users for an indefinite amount of time. Details...
Prototype Pollution
Overview flat-to-nested is a Convert a hierarchy from flat to nested representation. Affected versions of this package are vulnerable to Prototype Pollution in the convert function when processing input records containing specially crafted parent or id values such as proto. An attacker can inject...
CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instance
Impact CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instance, allowing local interception of NetNamedPipe traffic. NetNamedPipe creates a shared memory object based on the listening url, then generated a unique GUID for the named pipe it will be using and saves this ...
CVE-2026-50519
The CVE-2026-50519 entry concerns GitHub Copilot and Visual Studio Code where a resource initialized with an insecure default can allow an unauthorized attacker to disclose information over a network. Public sources (NVD) describe the impact as confidentiality compromise with network-exposed disc...
CVE-2019-25754
creationtimestamp| type| source ---|---|--- 2026-06-19 19:49:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moo4fipdtx2i...
CVE-2019-25756
creationtimestamp| type| source ---|---|--- 2026-06-19 19:30:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moo3cxp2gs27...
CVE-2019-25750
creationtimestamp| type| source ---|---|--- 2026-06-19 19:22:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moo2wblkl32h...
CVE-2026-49338
The CVE covers gonic, a Subsonic-compatible music server. Before 0.21.0, Subsonic API endpoints /rest/deletePlaylist.view and /rest/getPlaylist.view allowed any authenticated user to delete or read any other user’s private playlist due to missing per-resource authorization. The playlist ID is bas...
CVE-2017-20273
creationtimestamp| type| source ---|---|--- 2026-06-19 18:49:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3monz2heaaq2z...
CGA-998F-MFGR-V7C9
Bulletin has no description...
CVE-2026-49339 Path traversal in getPlaylist/deletePlaylist bypasses ownership check: any authenticated user can read or delete any other user's playlist
gonic is a music streaming server / free-software subsonic server API implementation. The maintainer's fix in commit 6dd71e6a3c966867ef8c900d359a7df75789f410 added an ownership check based on playlist.UserID. However, playlist.UserID is derived from the first path segment of the attacker-controll...
CGA-6FR8-38F7-7RW8
Bulletin has no description...
CVE-2026-56211
creationtimestamp| type| source ---|---|--- 2026-06-19 17:49:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3monvpu3zau2k...
EUVD-2019-20197
Joomla! Component JoomCRM 1.1.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the dealid parameter. Attackers can send GET requests to index.php with option=comjoomcrm&view=contacts and inject SQL...