3342 matches found
Exploit for CVE-2026-63030
No d...
CGA-4MW4-96W7-P432
Bulletin has no description...
CVE-2024-23569
HCL Aftermarket EPC is vulnerable to attack since the server is not configured with “X-XSS-Protection" header...
MINI-M7C8-GVF8-V8FP
Bulletin has no description...
CVE-2026-60062
creationtimestamp| type| source ---|---|--- 2026-07-15 17:07:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqp7hsjask2o 2026-07-16 13:00:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mqrc4ik4ie2t 2026-07-18 20:00:40+00:00| seen|...
CVE-2026-45150
Zen is a firefox-based browser. Prior to 1.19.13b, Zen Browser did not provide a persistent, clearly visible security notification when a webpage entered fullscreen mode, allowing an attacker-controlled page to hide the real browser UI and origin information, imitate a trusted website UI, and...
CVE-2026-45150
Zen is a firefox-based browser. Prior to 1.19.13b, Zen Browser did not provide a persistent, clearly visible security notification when a webpage entered fullscreen mode, allowing an attacker-controlled page to hide the real browser UI and origin information, imitate a trusted website UI, and...
CVE-2026-50353
creationtimestamp| type| source ---|---|--- 2026-07-14 19:01:54+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0231 2026-07-14 22:02:35+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:01:34+00:00| seen|...
CVE-2026-50480
creationtimestamp| type| source ---|---|--- 2026-07-14 19:01:37+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0231 2026-07-14 22:05:00+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:01:18+00:00| seen|...
CVE-2026-50442
creationtimestamp| type| source ---|---|--- 2026-07-14 19:01:35+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0231 2026-07-14 22:03:52+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:01:16+00:00| seen|...
CVE-2026-34346
creationtimestamp| type| source ---|---|--- 2026-07-14 19:01:29+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0231 2026-07-14 22:03:37+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:01:10+00:00| seen|...
CVE-2026-50314
creationtimestamp| type| source ---|---|--- 2026-07-14 19:00:55+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0237 2026-07-14 22:02:12+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:00:49+00:00| seen|...
[SECURITY] Fedora 43 Update: prometheus-3.13.1-1.fc43
The Prometheus monitoring system and time series database...
UBUNTU-CVE-2026-15697
A vulnerability was found in svgdotjs svg.js up to 3.2.5. This affects the function EventTarget.on of the file svgdotjs/svg.js of the component npm Package API. Performing a manipulation results in improperly controlled modification of object prototype attributes. The attack may be initiated...
Apache Airflow has an Authorization Bypass Through User-Controlled Key
The Event Log detail endpoint GET /api/v2/eventLogs/eventlogid in Apache Airflow fetched audit-log rows directly by numeric ID after only the generic Audit Log permission check, while the collection endpoint GET /api/v2/eventLogs applied per-Dag scoping. An authenticated UI/API user with audit-lo...
docling-graph has SSRF via Missing Internal IP Validation in URLInputHandler
ImpactThe URLInputHandler class in doclinggraph/core/input/handlers.py makes HTTP requests to user-supplied URLs without validating whether the target resolves to a private, loopback, or link-local IP address. The URLValidator only checks for a valid scheme and non-empty netloc, performing no...
PYSEC-2026-2362 Apache Airflow Exposes Secrets in Variables Saved as JSON Dictionaries
Secrets in Variables saved as JSON dictionaries were not properly redacted - in case the variables were retrieved by the user the secrets stored as nested fields were not masked. If developers do not store variables with sensitive values in JSON form, their projects are not affected. Otherwise...
mcp-server-git : Path traversal in git_add allows staging files outside repository boundaries
In mcp-server-git versions prior to 2026.1.14, the gitadd tool did not validate that file paths provided in the files argument were within the repository boundaries. The tool used GitPython's repo.index.add, which did not enforce working-tree boundary checks for relative paths. As a result,...
Malicious Package
Overview decimal-format-core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...