32929 matches found
CVE-2026-72834 filebrowser before 2.63.19 Permission Bypass via checksum
filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum ?checksum= branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check unlike the sibling raw, preview, and subtitle paths. As a...
CVE-2026-72834 filebrowser before 2.63.19 Permission Bypass via checksum
filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum ?checksum= branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check unlike the sibling raw, preview, and subtitle paths. As a...
EUVD-2026-58648
filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum ?checksum= branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check unlike the sibling raw, preview, and subtitle paths. As a...
GO-2024-2597 vulnerabilities
Vulnerabilities for packages: spicedb...
GO-2026-5658 vulnerabilities
Vulnerabilities for packages: goreleaser...
GO-2023-2070 vulnerabilities
Vulnerabilities for packages: croc...
EUVD-2026-58503
Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in identifiers. Attackers with write permission on a table with a double-quote in its name can inject SQL that executes as the datasource's...
EUVD-2026-58500
Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a victim's account. Attackers can craft a phishing page that auto-submits a POST request with a leaked confirmation token to bind...
EUVD-2026-58547
filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is enabled with default CreateUserDir setting. Unauthenticated attackers can register accounts that inherit the server root scope with full create, modify, delete, rename, share, and download permissions...
PT-2026-72051
Dell Wyse Management Suite WMS, versions prior to 2605.0.2, contain an Incorrect Default Permission vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation...
CVE-2026-72839
filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is enabled with default CreateUserDir setting. Unauthenticated attackers can register accounts that inherit the server root scope with full create, modify, delete, rename, share, and download permissions...
CVE-2026-72853 Budibase before 3.40.0 SQL Injection via Oracle connector
Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in identifiers. Attackers with write permission on a table with a double-quote in its name can inject SQL that executes as the datasource's...
CVE-2026-54399 vulnerabilities
Vulnerabilities for packages: airbyte-server, floci, nrjmx, reposilite, conductor-fips, nacos, kserve-modelmesh, jmeter, elasticsearch, floci-az, kayenta-fips, nuxeo, kayenta, opensearch, pinot, nacos-docker, jbang, wso2is, cassandra-reaper, logstash-fips, airbyte-platform-fips, druid, conductor,...
CVE-2026-73653
Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied file paths without enforcing the allowWri...
EUVD-2026-58197
Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied file paths without enforcing the allowWri...
CVE-2026-73653
Vitest (framework powered by Vite) has a vulnerability in Browser Mode provider commands prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6. The commands—upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces—accept browser-supplied file paths without enforcin...
CVE-2026-73653 Vitest: Browser Mode provider commands bypass the file-access permission gate
Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied file paths without enforcing the allowWri...
CVE-2026-73653 Vitest: Browser Mode provider commands bypass the file-access permission gate
Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied file paths without enforcing the allowWri...
CVE-2026-58432
Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea...