85722 matches found
CVE-2026-15779 Samba-winbind: samba: pam_winbind mkhomedir chowns critical system paths without validation
A flaw was found in samba's pamwinbind. When mkhomedir is enabled, pamwinbind chowns the target account's home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as their home directory a common default for system accounts can...
DEBIAN-CVE-2026-61872
ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the TIFF encoder when an invalid tiff:tile-geometry is specified. Supplying malformed tile geometry parameters causes allocated memory not to be released, which can lead to increased memory consumption...
CVE-2026-61452
The Grav API plugin getgrav/grav-plugin-api before 2.0.4 contains an improper session invalidation vulnerability where JWT access tokens are issued without a jti JWT ID claim and therefore cannot be revoked server-side. Unlike refresh tokens, access tokens remain valid for their full lifetime...
EUVD-2026-44638
PraisonAI before 4.6.78 exposes the MCP HTTP-stream transport without authentication by default: the CLI --api-key option defaults to None, and the server only enforces Authorization/Bearer checks when an API key is configured. When an operator runs 'praisonai mcp serve --transport http-stream'...
CVE-2026-57996
phpMyFAQ prior to 4.1.5 contains a privilege-escalation flaw in the admin/user-add endpoint. A delegated administrator with USER_ADD/EDIT/DELETE can call POST /admin/api/user/add using isSuperAdmin: true and attacker-chosen credentials to create a SuperAdmin account, enabling full instance takeov...
Missing Authorization
Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Missing Authorization in the RoleContainerResource admin REST composite-role endpoints. A delegated...
Missing Authorization
Overview org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Missing Authorization in the RoleContainerResource admin REST composite-role endpoints. A delegated...
CVE-2026-59235
Missing Authorization CWE-862 in BankAccountListController app/Http/Controllers/Api/BankAccount/BankAccountListController.php, exposed at GET /api/bank-account, in Prospero Flow CRM companyid-get, performing only company scoping and no role or permission check before returning the data. This...
MINI-5954-HWXH-7CRJ
Bulletin has no description...
MINI-J7RX-6RC8-PP28
Bulletin has no description...
MINI-JP83-53VC-CQG2
Bulletin has no description...
MINI-5R5Q-Q4CC-53GW
Bulletin has no description...
MINI-5QJM-2587-CX3M
Bulletin has no description...
MINI-9PJG-P2WW-X9J4
Bulletin has no description...
MINI-2Q5G-WRHH-GG4H
Bulletin has no description...
MINI-78Q8-5RQ9-4J2X
Bulletin has no description...
MINI-QHXC-R6FX-W59V
Bulletin has no description...
MINI-6MWJ-9WF9-W4MR
Bulletin has no description...