22102 matches found
CVE-2026-77317 SeaweedFS: SFTP path ACL literal prefix match permits cross-tenant file read and overwrite
SeaweedFS is a distributed storage system for files and blobs. In versions from 3.88 through 4.39, the SFTP server evaluates configured path permissions with a literal string-prefix comparison, so a user scoped to a path is also granted the same access to any sibling path whose name merely begins...
CVE-2026-77317 SeaweedFS: SFTP path ACL literal prefix match permits cross-tenant file read and overwrite
SeaweedFS is a distributed storage system for files and blobs. In versions from 3.88 through 4.39, the SFTP server evaluates configured path permissions with a literal string-prefix comparison, so a user scoped to a path is also granted the same access to any sibling path whose name merely begins...
CVE-2025-61162
Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/internal/v1/users/USERID endpoint...
CVE-2026-59682
Arbitrary file overwrite via SAVEPROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3...
CVE-2026-59682
Arbitrary file overwrite via SAVEPROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3...
UBUNTU-CVE-2026-59682
Arbitrary file overwrite via SAVEPROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3...
CVE-2026-18794
OpenRGB is vulnerable in its network protocol due to insufficient input data validation. An attacker can pass inconsistent data over the network to cause memory exhaustion and out-of-bounds memory reads and writes , leading to denial-of-service and potential memory corruption. The vulnerability i...
CVE-2026-18794 OpenRGB: insufficient input data checks lead to Denial-of-Service, memory overread and overwrite
The OpenRGB network protocol allows attackers to cause memory exhaustion and out-of-bounds memory reads and writes by passing inconsistent data...
CVE-2026-59682
Arbitrary file overwrite via SAVEPROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3...
CVE-2026-59682
OpenRGB through 1.0rc3 is affected by an arbitrary file overwrite and deletion vulnerability via the SAVE_PROFILE message, allowing both local and remote exploitation. Per CVSS 3.1, this is rated CRITICAL (9.1) with a network attack vector requiring no privileges and no user interaction , resulti...
CVE-2026-59682
Arbitrary file overwrite via SAVEPROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3...
CVE-2026-59682 Arbitrary file overwrite and deletion local and remote in OpenRGB
Arbitrary file overwrite via SAVEPROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3...
CVE-2026-59682 Arbitrary file overwrite and deletion local and remote in OpenRGB
Arbitrary file overwrite via SAVEPROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3...
CVE-2026-59682 Arbitrary file overwrite and deletion local and remote in OpenRGB
Arbitrary file overwrite via SAVEPROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3...
CVE-2026-14212
The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee provider owns the provider account being updated, allowing any employee with an Employee Panel login to overwrite another employee's cabinet password and take over their...
CVE-2026-14212
The Booking for Appointments and Events Calendar WordPress plugin (specifically Amelia Pro ) versions before 9.8 is vulnerable to an Insecure Direct Object Reference (IDOR) . The application fails to verify that an authenticated employee (provider) owns the provider account being updated. This al...
CVE-2026-14212 Amelia Pro < 9.8 - Provider+ Arbitrary Provider Password Update via IDOR
The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee provider owns the provider account being updated, allowing any employee with an Employee Panel login to overwrite another employee's cabinet password and take over their...
CVE-2026-14212 Amelia Pro < 9.8 - Provider+ Arbitrary Provider Password Update via IDOR
The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee provider owns the provider account being updated, allowing any employee with an Employee Panel login to overwrite another employee's cabinet password and take over their...
RLSA-2026:22112 Important: go-toolset:rhel8 security update
Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fixes: net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 cmd/go: golang: Go command cmd/go: Integrity bypass due to checksum...
