87893 matches found
CVE-2026-57206 SimpleChat plugin validation endpoints missing authentication and authorization
SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.206, several plugin validation routes in application/singleapp/pluginvalidationendpoint.py, including POST /api/admin/plugins/test-instantiation, GET...
CVE-2026-14890
SGLang is vulnerable to unauthenticated remote code execution via its expert-parallel backup subsystem. The issue centers on a ZeroMQ PULL socket exposed on a routable network interface with no authentication or deserialization safeguards, allowing an attacker to send a malicious pickle payload t...
google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 :path pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed :path that omits the mandato...
Uncontrolled Resource Consumption
github.com/aquasecurity/trivy is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to the custom tar unpacker reading Helm chart archive .tgz entries using io.ReadAll without enforcing a size limit, which allows an attacker to supply a malicious compressed archive that...
CVE-2026-35145
HCL DFXAnalytics is affected by a Missing HTTP Strict-Transport-Security Header vulnerability. The application fails to implement the HTTP Strict Transport Security HSTS policy within its responses, which could allow a remote attacker to downgrade the communication channel to an unencrypted...
CVE-2026-35140
HCL DFXAnalytics is affected by a Missing Secure Attribute in Encrypted Session SSL Cookie vulnerability. The application fails to set the "secure" attribute on session cookies generated during authentication, which could allow a remote attacker to intercept network traffic and capture sensitive...
MINI-RJ2M-6853-WXH4
Bulletin has no description...
MINI-QJX6-WMMV-QGPP
Bulletin has no description...
MINI-G7GM-XVF3-JHXX
Bulletin has no description...
MINI-74QJ-RM7C-6XM4
Bulletin has no description...
MINI-7CWJ-22WG-RQFM
Bulletin has no description...
MINI-8H45-WRM6-7GMC
Bulletin has no description...
MINI-334M-9JWF-3F8P
Bulletin has no description...
MINI-MF84-J4F7-86HR
Bulletin has no description...
MINI-RG95-QRV5-8G9X
Bulletin has no description...
MINI-6PFH-53X8-3R7V
Bulletin has no description...
MINI-M3MM-9F47-4M7V
Bulletin has no description...
MINI-8V66-27M5-FVPW
Bulletin has no description...