190267 matches found
CVE-2026-9589
The Collaboration Server in Unblu Spark (versions 7.0 through 8.36.1-hotfix.0) is vulnerable to a missing authorization flaw during configuration cascade operations. The system fails to verify if a user has the necessary permissions to read or modify the configuration of a specific entity. This a...
CVE-2026-9589 Unblu Spark Authorization Bypass in Configuration Cascade Operations
Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren't...
EUVD-2026-104932
Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren't...
CVE-2026-9589 Unblu Spark Authorization Bypass in Configuration Cascade Operations
Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren't...
CVE-2026-113354 Dockhand before 1.0.46 Arbitrary File Read via /api/system/files/content
Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of /api/system/files/content. Attackers can supply absolute paths to read /etc/shadow, /etc/passwd, git .git/config credentials, an...
CVE-2026-113354
Versions of Dockhand prior to 1.0.46 are vulnerable to an arbitrary file read vulnerability via the /api/system/files/content endpoint. This issue stems from incorrect authorization (CWE-863), allowing non-admin users possessing stacks:edit permissions to access files by supplying absolute paths....
CVE-2026-113354 Dockhand before 1.0.46 Arbitrary File Read via /api/system/files/content
Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of /api/system/files/content. Attackers can supply absolute paths to read /etc/shadow, /etc/passwd, git .git/config credentials, an...
EUVD-2026-104925
Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of /api/system/files/content. Attackers can supply absolute paths to read /etc/shadow, /etc/passwd, git .git/config credentials, an...
CVE-2026-113354 Dockhand before 1.0.46 Arbitrary File Read via /api/system/files/content
Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of /api/system/files/content. Attackers can supply absolute paths to read /etc/shadow, /etc/passwd, git .git/config credentials, an...
CVE-2026-43851
A path traversal vulnerability could allow an authenticated attacker to read arbitrary files on the system...
CVE-2026-43849
A heap memory read vulnerability could allow an attacker to exfiltrate sensitive data...
SUSE-SU-2026:24366-1 Security update for libXi
This update for libXi fixes the following issues: - CVE-2026-93541: Out-of-bounds read in libXi's XQueryDeviceState bsc1281605. - CVE-2026-93542: Out-of-bounds read in libXi's XI2 class parsing via sizeclasses and copyclasses bsc1281606. - CVE-2026-93543: Out-of-bounds read in libXi's XI2 class...
Security update for libXi
This update for libXi fixes the following issues: CVE-2026-93541: Out-of-bounds read in libXi's XQueryDeviceState bsc1281605. CVE-2026-93542: Out-of-bounds read in libXi's XI2 class parsing via sizeclasses and copyclasses bsc1281606. CVE-2026-93543: Out-of-bounds read in libXi's XI2 class parser...
CVE-2026-101201
A flaw was found in Qt. An out-of-bounds read vulnerability can occur when parsing a binary file with a malformed header in the QBinaryJson::fromBinaryData function. An attacker could exploit this flaw by convincing a user or application to process a specially crafted binary file, causing the...
CVE-2026-112238
The ameos_filemanager extension contains an SQL Injection vulnerability (CWE-89) within its file search functionality. The application fails to escape quote characters when building database conditions, only escaping wildcard characters for the LIKE operator. Consequently, a crafted search term c...
CVE-2026-112238 SQL Injection in extension "File manager" (ameos_filemanager)
The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator are escaped, quote characters are not. A crafted search term can therefore leave the intended string value and change the database query...
CVE-2026-112238 SQL Injection in extension "File manager" (ameos_filemanager)
The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator are escaped, quote characters are not. A crafted search term can therefore leave the intended string value and change the database query...
DEBIAN-CVE-2026-101201
A malformed header in the binary file fed to QBinaryJson::fromBinaryData can cause undefined behaviour because of out-of-bounds read...