19285 matches found
PT-2026-88086
Name of the Vulnerable Software and Affected Versions PIMBoards affected versions not specified Description An unauthenticated attacker can perform read operations intended exclusively for PIMBoards users, leading to information disclosure. Write operations are not affected. Recommendations At th...
CVE-2026-9215: Cross-Site Request Forgery (CSRF)
A cross site request forgery CSRF vulnerability in the listed NETGEAR models allows an attacker who can leverage social engineering techniques on a router administrator to tamper with router configuration and disrupt router operations with active assistance from the router administrator. There is...
CVE-2026-82067: Improper Handling of Case Sensitivity
Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition occurs can perform...
CVE-2026-86512: Improper Access Control
A vulnerability was identified in java-json-tools json-patch up to 1.13. This affects the function CopyOperation.apply/MoveOperation.apply of the file src/main/java/com/github/fge/jsonpatch/CopyOperation.java of the component Copy Move Operations. The manipulation leads to improper access control...
CVE-2026-77098: Improper Neutralization of Special Elements used in an SQL Command
Private Metrics Server contained an SQL injection condition affecting database operations. Software customers upgrade to resolved maintenance release. Update Private Metrics Server...
CVE-2026-5729: Use After Free
Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform valid GPU processing operations to access already freed memory. This issue affects Valhall GPU Kernel Driver: from r50p0...
CVE-2026-79602: Improper Restriction of Operations within the Bounds of a Memory Buffer
A guest with a PCI device assigned that has at least a BAR on the IO port space can trigger a BUG in Xen...
PT-2026-87174
AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation list, min, max, first, sum, avg that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact forbidden fields on returned records...
PT-2026-87160
Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description Improper handling of case sensitivity in the configuration validation component may cause the authorization subsystem to remain in a default disabled state during server startup. This...
CVE-2026-76560 389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dn
A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated...
ROS-20260907-73-0092
The vulnerability in dotnet10.0 is related to the lack of validation for input data during cyclic operations. Exploiting this vulnerability can allow an attacker to cause a service failure...
ROS-20260907-73-0089
The vulnerability in dotnet9.0 is related to the lack of validation for input data during cyclic operations. Exploiting this vulnerability can allow an attacker to cause a service failure...
ROS-20260907-73-0091
The vulnerability in dotnet8.0 is related to the lack of input validation for cyclic operations. Exploiting this vulnerability can allow an attacker to cause a service failure...
Unity Linux 20.1050e Security Update: kernel (UTSA-2026-073363)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-073363 advisory. In the Linux kernel, the following vulnerability has been resolved: tracing: Do not call map-ops-eltfree if eltalloc fails In paths where tracingmapeltalloc failed t...
OESA-2026-3673 openssh security update
An open source implementation of SSH protocol version 2 Security Fixes: In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the...
OESA-2026-3674 openssh security update
An open source implementation of SSH protocol version 2 Security Fixes: In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the...
CVE-2026-86114
Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delete compose templates including instance-wide defaults. Attackers can inject malicious container configurations with privileged settings or host path mounts th...
CVE-2026-86118
gonic versions before 0.22.0 (a self-hosted media server by sentriz) contain a missing privilege check in the startScan endpoint of its Subsonic API. Because administrator privileges are not validated, any authenticated user can trigger a full media library rescan. An attacker can repeatedly invo...
PT-2026-105770
The /v1/agents/import endpoint and AgentRegistry.import agent in local-operator versions before 0.47.5 trust the id field inside agent.yml of an uploaded agent profile archive when constructing the destination directory. A crafted id containing directory traversal sequences makes shutil.rmtree an...