232847 matches found
CVE-2026-56784 OpenRemote < 1.25.0 IDOR via Bulk Alarm Deletion Endpoint
OpenRemote before 1.25.0 contains an insecure direct object reference IDOR vulnerability in the bulk alarm deletion endpoint that allows authenticated users to permanently delete alarms belonging to other tenants by supplying arbitrary alarm IDs. The removeAlarms method in AlarmResourceImpl.java...
EUVD-2026-38444
OpenRemote Manager before 1.24.2 contains an insecure direct object reference vulnerability in the removeAlarms method that allows authenticated users to delete alarms from other tenants by supplying arbitrary alarm IDs. The bulk deletion endpoint fails to validate that targeted alarm IDs belong ...
CVE-2026-56784 OpenRemote < 1.25.0 IDOR via Bulk Alarm Deletion Endpoint
OpenRemote before 1.25.0 contains an insecure direct object reference IDOR vulnerability in the bulk alarm deletion endpoint that allows authenticated users to permanently delete alarms belonging to other tenants by supplying arbitrary alarm IDs. The removeAlarms method in AlarmResourceImpl.java...
CVE-2026-56784
OpenRemote Manager before 1.24.2 contains an insecure direct object reference in removeAlarms(), enabling authenticated users to delete alarms across tenants by supplying arbitrary alarm IDs. The bulk deletion endpoint does not validate that IDs belong to the caller’s realm, enabling cross-tenant...
urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers
A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via ProxyManager.connectionfromurl.urlopen with assertsamehost=False, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitiv...
urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers
A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via ProxyManager.connectionfromurl.urlopen with assertsamehost=False, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitiv...
urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers
A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via ProxyManager.connectionfromurl.urlopen with assertsamehost=False, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitiv...
CVE-2026-41178 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-kinesis-fips, dkron-fips, scorecard, grype-fips, blob-csi, eks-distro, crossplane-provider-kubernetes, cluster-autoscaler-fips, prometheus-alertmanager-fips, cluster-api-azure-controller-fips, crossplane-provider-aws-kms-fips,...
GHSA-5WRP-CWCJ-Q835 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-kinesis-fips, dkron-fips, scorecard, grype-fips, blob-csi, eks-distro, crossplane-provider-kubernetes, cluster-autoscaler-fips, prometheus-alertmanager-fips, cluster-api-azure-controller-fips, crossplane-provider-aws-kms-fips,...
GHSA-JPCC-P29G-P8MQ vulnerabilities
Vulnerabilities for packages: scorecard, grype-fips, docker-cli-buildx-fips, newrelic-infrastructure-agent, cloudbeat, chartmuseum, headlamp-fips, crossplane, rancher-agent, steampipe, skaffold-fips, chaos-mesh-fips, newrelic-infrastructure-agent-fips, docker-fips, cluster-api-helm-controller-fip...
CVE-2026-12151 vulnerabilities
Vulnerabilities for packages: code-server, kibana, prism, saf, haraka, pelias-api, vitess, py3-captum, renovate, actions-runner, gemini-cli, node-gyp, npm...
GHSA-P88M-4JFJ-68FV vulnerabilities
Vulnerabilities for packages: code-server, kibana, prism, saf, haraka, pelias-api, vitess, py3-captum, renovate, actions-runner, gemini-cli, node-gyp, npm...
GHSA-G8M3-5G58-FQ7M vulnerabilities
Vulnerabilities for packages: code-server, kibana, prism, saf, haraka, pelias-api, vitess, py3-captum, renovate, actions-runner, gemini-cli, node-gyp, npm...
CVE-2026-11525 vulnerabilities
Vulnerabilities for packages: code-server, kibana, prism, saf, haraka, pelias-api, vitess, py3-captum, renovate, actions-runner, gemini-cli, node-gyp, npm...
GHSA-35P6-XMWP-9G52 vulnerabilities
Vulnerabilities for packages: code-server, kibana, prism, saf, haraka, pelias-api, vitess, py3-captum, renovate, actions-runner, gemini-cli, node-gyp, npm...
CVE-2026-6733 vulnerabilities
Vulnerabilities for packages: code-server, kibana, prism, saf, haraka, pelias-api, vitess, py3-captum, renovate, actions-runner, gemini-cli, node-gyp, npm...
CVE-2026-9679 vulnerabilities
Vulnerabilities for packages: code-server, kibana, prism, saf, haraka, pelias-api, vitess, py3-captum, renovate, actions-runner, gemini-cli, node-gyp, npm...
CVE-2026-8378
The Frontend File Manager Plugin WordPress plugin through 23.6 does not sanitise nor escape a filename submitted to the frontend file-rename endpoint before storing it as post meta and rendering it back on the admin File Manager listing, leading to a Stored Cross-Site Scripting vulnerability...
CVE-2026-8379
The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly enforce its nonce check on the file download handler, allowing unauthenticated attackers to download files uploaded by any user through the Frontend File Manager Plugin WordPress plugin through 23.6 by iterating...
EUVD-2026-38419
The Frontend File Manager Plugin WordPress plugin through 23.6 does not sanitise nor escape a filename submitted to the frontend file-rename endpoint before storing it as post meta and rendering it back on the admin File Manager listing, leading to a Stored Cross-Site Scripting vulnerability...