179749 matches found
EUVD-2026-92804
Docling has arbitrary file read/write and command execution when shell-escape is enabled when rendering untrusted TikZ with the opt-in Tectonic engine...
Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine
Summary When the LaTeX backend is configured to render TikZ pictures with the Tectonic engine LatexBackendOptionstikzengine="tectonic", the TikZ body and the document preamble from the input file are compiled by Tectonic without any restriction on TeX's file primitives. A crafted .tex file can re...
GHSA-X3Q2-H9HX-4R4J Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine
Summary When the LaTeX backend is configured to render TikZ pictures with the Tectonic engine LatexBackendOptionstikzengine="tectonic", the TikZ body and the document preamble from the input file are compiled by Tectonic without any restriction on TeX's file primitives. A crafted .tex file can re...
EUVD-2026-92796
Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers...
EUVD-2026-92766
Ghost: Path Traversal via Locale Setting...
GHSA-M382-6JW4-FMP6 Ghost: Path Traversal via Locale Setting
Impact A vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read JSON files outside of the active theme's directory, potentially exposing server configuration secrets. Vulnerable versions This vulnerability is present in Ghost from v1.20.0 up to...
CVE-2026-34499
Use of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allows Read Sensitive Constants Within an Executable. This issue affects ADVMS: before 3.10...
CVE-2026-34499
Use of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allows Read Sensitive Constants Within an Executable. This issue affects ADVMS: before 3.10...
CVE-2026-34499
The Johnson Controls ADVMS software version before 3.10 is affected by a use of hard-coded cryptographic key (CWE-321) vulnerability. This flaw allows an attacker to Read Sensitive Constants Within an Executable . The vulnerability has a CVSS 4.0 base score of 8.5 (High) , with a local attack vec...
EUVD-2026-94578
Use of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allows Read Sensitive Constants Within an Executable. This issue affects ADVMS: before 3.10...
CVE-2026-34499
Use of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allows Read Sensitive Constants Within an Executable. This issue affects ADVMS: before 3.10...
CVE-2026-46571
A flaw was found in ntfs-3g. This vulnerability allows an attacker to read sensitive data from process memory, resulting in information disclosure, by supplying a maliciously crafted NTFS filesystem image. When the system attempts to inspect a corrupted file within the image, an out-of-bounds rea...
CVE-2026-107176
A vulnerability exists in the cluster-samples-operator where the RBAC Role coreos-pull-secret-reader in the openshift-config namespace grants excessive permissions. The role provides get, list, and watch access to all Secret resources because it lacks resourceNames scoping, even though the operat...
Security Bulletin: Multiple vulnerabilities affect IBM Cloud Pak System
Summary Multiple vulnerabilities affect IBM Cloud Pak System. These vulnerabilties have been addressed with IBM Cloud Pak System 2.3.5.1. Vulnerability Details CVEID:CVE-2025-15467 DESCRIPTION: Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD...
CVE-2026-107221 Excelize: a row whose earlier cell has a higher column reference than its last cell panics index out of range on almost every worksheet read API
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0, checkRow sizes its target cell slice from the last cell in XML document order and then re-scatters every cell by its explicit column reference. GetCellValue reaches workSheetReader and...
CVE-2026-107221 Excelize: a row whose earlier cell has a higher column reference than its last cell panics index out of range on almost every worksheet read API
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0, checkRow sizes its target cell slice from the last cell in XML document order and then re-scatters every cell by its explicit column reference. GetCellValue reaches workSheetReader and...
CVE-2026-107221
The Excelize Go library (versions 2.0.0 to 2.11.0 ) is vulnerable to an out-of-bounds write (CWE-787) during non-streaming worksheet read operations. The root cause lies in the checkRow function, which incorrectly sizes a target cell slice based on the last cell in XML document order. If a crafte...
CVE-2026-107221 Excelize: a row whose earlier cell has a higher column reference than its last cell panics index out of range on almost every worksheet read API
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0, checkRow sizes its target cell slice from the last cell in XML document order and then re-scatters every cell by its explicit column reference. GetCellValue reaches workSheetReader and...
Deserialization of Untrusted Data
Overview @backstage/plugin-techdocs-node is a Common node.js functionalities for TechDocs, to be shared between techdocs-backend plugin and techdocs-cli Affected versions of this package are vulnerable to Deserialization of Untrusted Data in sanitizeMkdocsYml within mkdocsPatchers.ts via malforme...
Backstage has a sensitive information disclosure in Kubernetes resource queries
Impact An authenticated user holding the standard Kubernetes resource read permission could retrieve sensitive values that the Kubernetes plugin is designed to mask, potentially exposing credentials and other confidential material held in the connected clusters. Exposure is limited to resources...