54694 matches found
CVE-2026-53456
Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio terminal SSH key authentication in customcomponents/blueprintstudio/backend/terminalmanager.py wrote SSH private-key material to a file under the Home Assistant configuration...
CVE-2026-66780
A flaw was found in the submariner-operator component. The submariner-k8s-broker-cluster Role, which is assigned to joined clusters, possesses excessive permissions. This allows a compromised cluster to alter network configurations, specifically by overwriting other clusters' endpoint information...
EUVD-2026-61078
A flaw was found in the submariner-operator component. The submariner-k8s-broker-cluster Role, which is assigned to joined clusters, possesses excessive permissions. This allows a compromised cluster to alter network configurations, specifically by overwriting other clusters' endpoint information...
CVE-2026-66780
Submariner-operator contains a flaw where the submariner-k8s-broker-cluster Role, assigned to joined clusters, holds excessive permissions. A compromised cluster can overwrite other clusters' endpoint information, redirecting inter-cluster tunnel traffic and enabling a Man-in-the-Middle (MITM) at...
CVE-2026-75924
A flaw was found in managed-serviceaccount. A compromised addon-manager pod, due to its ClusterRole granting excessive permissions, can read any secret across all namespaces. Additionally, it can approve arbitrary Certificate Signing Requests CSRs, which could lead to information disclosure and...
CVE-2026-66780
A flaw was found in the submariner-operator component. The submariner-k8s-broker-cluster Role, which is assigned to joined clusters, possesses excessive permissions. This allows a compromised cluster to alter network configurations, specifically by overwriting other clusters' endpoint information...
GO-2026-6190 Unsafe file permission restoration from metadata in github.com/rclone/rclone
Unsafe file permission restoration from metadata in github.com/rclone/rclone...
CVE-2026-75924 Managed-serviceaccount: managed-serviceaccount: hub addon-manager clusterrole grants cluster-wide secret read/write and csr approval
A flaw was found in managed-serviceaccount. A compromised addon-manager pod, due to its ClusterRole granting excessive permissions, can read any secret across all namespaces. Additionally, it can approve arbitrary Certificate Signing Requests CSRs, which could lead to information disclosure and...
CVE-2026-75926
Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directory. Hugo 0.162.0 added tailwindcss to the AllowChildProcess default in...
CVE-2026-75926
Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directory. Hugo 0.162.0 added tailwindcss to the AllowChildProcess default in...
UBUNTU-CVE-2026-75926
Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directory. Hugo 0.162.0 added tailwindcss to the AllowChildProcess default in...
EUVD-2026-61017
MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not verify private event status consistently, allowing users with viewing and moderation permissions to access and moderate private events. The private-event check used by getevents in inc/functionscalendar.php...
CVE-2026-45120
MyBB (free and open source forum software) versions prior to 1.8.40 contain an authorization flaw in the calendar module . The private-event check implemented in get_events() within inc/functions_calendar.php and the event action is missing from the remaining calendar.php actions. This allows use...
CVE-2026-75924
A flaw was found in managed-serviceaccount. A compromised addon-manager pod, due to its ClusterRole granting excessive permissions, can read any secret across all namespaces. Additionally, it can approve arbitrary Certificate Signing Requests CSRs, which could lead to information disclosure and...
CVE-2026-75926
Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directory. Hugo 0.162.0 added tailwindcss to the AllowChildProcess default in...
CVE-2026-59781
When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory allowed unauthorized users to modify its contents, an attacker could place a malicious DLL that could...
CVE-2026-59781 Improper validation of custom installation directories on Windows could allow installation into locations with unsafe permissions, increasing the risk of DLL sideloading.
When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory allowed unauthorized users to modify its contents, an attacker could place a malicious DLL that could...
EUVD-2026-60742
When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory allowed unauthorized users to modify its contents, an attacker could place a malicious DLL that could...
CVE-2026-59781
The Zabbix Agent Windows installer did not validate directory permissions during custom-path installation, allowing attackers to drop a malicious DLL that gets loaded by the agent, enabling arbitrary code execution. The fix detects unsafe directories and requires explicit user confirmation before...
PT-2026-76964
Name of the Vulnerable Software and Affected Versions Zabbix Agent affected versions not specified Description When installed on Windows in a custom directory, the installer fails to verify if the selected location has secure access permissions. This allows an attacker to place a malicious DLL in...