1680 matches found
grafana: Grafana: Unauthorized public dashboard deletion across organizations
A flaw in Grafana's public dashboard deletion endpoint lacks organization isolation, allowing an Organization Administrator to delete public dashboards in other organizations using the target dashboard's ID...
CVE-2026-86667
A weakness has been identified in aircheng-org iWebShop-5 up to 5.15. The affected element is the function memberlist of the file controllers/member.php. This manipulation of the argument Search causes sql injection. The attack is possible to be carried out remotely. The exploit has been made...
CVE-2026-86669 aircheng-org iWebShop-5 systemseller.php login improper authentication
A vulnerability was detected in aircheng-org iWebShop-5 up to 5.15. This affects the function Login of the file controllers/systemseller.php. Performing a manipulation of the argument Name results in improper authentication. It is possible to initiate the attack remotely. The exploit is now publi...
CVE-2026-86668 aircheng-org iWebShop-5 pic.php uploadFile cross site scripting
A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.15. The impacted element is the function uploadFile of the file controllers/pic.php. Such manipulation of the argument outerSrc/selectPhoto leads to cross site scripting. The attack may be performed from remote. The...
CVE-2026-86667 aircheng-org iWebShop-5 member.php member_list sql injection
A weakness has been identified in aircheng-org iWebShop-5 up to 5.15. The affected element is the function memberlist of the file controllers/member.php. This manipulation of the argument Search causes sql injection. The attack is possible to be carried out remotely. The exploit has been made...
CVE-2026-86808: Missing Authentication for Critical Function
A security vulnerability has been detected in moltis-org moltis up to 20260818.10. The affected element is the function vaultunlockhandler/vaultrecoveryhandler of the file vault.rs. Such manipulation leads to missing authentication. The attack can be launched remotely. The exploit has been...
PT-2026-87105
A vulnerability was identified in aircheng-org iWebShop-5 up to 5.15. This issue affects the function Update::index of the file controllers/update.php. The manipulation leads to missing authorization. Remote exploitation of the attack is possible. The exploit is publicly available and might be...
ROS-20260908-73-0076
The vulnerability in mongodb-org is related to the lack of use of the assert function. Exploiting this vulnerability can allow a remote attacker to cause service failures...
ROS-20260908-73-0043
The vulnerability in mongodb-org is related to the lack of use of the assert function. Exploiting this vulnerability can allow a remote attacker to cause service failures...
ROS-20260908-73-0042
The vulnerability in mongodb-org is related to insufficient protection of registration data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...
ROS-20260908-73-0074
The vulnerability in mongodb-org is related to the lack of use of the assert function. Exploiting this vulnerability can allow a remote attacker to cause service failures...
ROS-20260908-73-0071
The vulnerability in mongodb-org is related to an uncontrolled recursion. Exploiting this vulnerability could allow an attacker to cause a service failure...
CVE-2026-86317
A vulnerability was detected in ggml-org llama.cpp up to 0.4.0. This impacts the function rpcserver::deserializetensor of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component RPC Server. Performing a manipulation of the argument ne results in reachable assertion. The attack is possible to be...
UBUNTU-CVE-2026-86317
A vulnerability was detected in ggml-org llama.cpp up to 0.4.0. This impacts the function rpcserver::deserializetensor of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component RPC Server. Performing a manipulation of the argument ne results in reachable assertion. The attack is possible to be...
PT-2026-86771
Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information. Several organisation-related widgets did not honor Security.hide organisation index from users. As a result, authenticated users without the perm sharing group...
CVE-2026-85538 MISP Attribute Deletion Authorization Bypass Allows Users Without Modify Permissions to Delete Attributes
An incorrect authorization vulnerability in MISP allowed authenticated users to delete attributes from events despite lacking the required permmodify or permmodifyorg permissions. The affected attribute deletion paths relied on organization membership checks performed by...
CVE-2026-85178 Helicone Cross-Tenant Provider Key Disclosure via Missing Organization Filter
Helicone's VaultManager.getDecryptedProviderKeyById function in the GET /v1/vault/key/providerKeyId endpoint fails to validate the requester's organization against the vault key's organization identifier. Attackers with admin or owner privileges in any organization can retrieve decrypted upstream...
PT-2026-85037
The PyPI Incident as the Harm Threshold Marker Of the four incidents, the Mythos 5 PyPI package upload is the only one confirmed to have produced real-world third-party harm: the package was downloaded and executed by external systems before it was caught Source: TechCrunch, July 31, 2026. The...