MLflow Weak Password Requirements Authentication Bypass Vulnerability

MLflow Weak Password Requirements Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability.The specific flaw exists within the handling of passwords. T...

PYSEC-2026-2090

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. UpdateCacheMiddleware and the cachepage decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache. Earlier,...

PYSEC-2026-1598 Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users

Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users...

PYSEC-2026-1812 Pydantic regular expression denial of service

Regular expression denial of service in Pydantic 2.4.0, 1.10.13 allows remote attackers to cause denial of service via a crafted email string...

PYSEC-2026-1798 Phone information disclosure vulnerability

Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via sending a crafted request...

PT-2026-56284

An issue in Oneblog V2.3.9 allows a remote attacker to obtain sensitive information via the RestApiController.java, JsApiTicketComponent.java, and the GetAccessTokenComponent.java component...

ROS-20260707-73-0006

The vulnerability in zabbix-lts is related to insufficient protection of registration data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability in Node.js’ follow-redirects module, related to information disclosure, allows attackers to gain access to confidential data.

The vulnerability in Node.js’ follow-redirects module is related to the exposure of information. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data...

EUVD-2026-41871

The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and content. This allows an unauthenticated remote attacker to inject malicious JSON data that can lead to a persistent denial of service conditio...

CVE-2026-44937

Potential forgery of webhook requests when using a unauthenticated webhook in SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.5 could be used by remote attackers to cause a denial of service or a downgrade attack on other repositories on the...

Matrix Synapse Improper Signature Validation

Matrix Synapse before 0.33.3.1 and 0.33.2.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper transaction and event signature validation...

CVE-2026-14809 PROG MIS｜Prog Management System - SQL Injection

Prog Management System developed by PROG MIS has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents...

CVE-2026-14808

CVE-2026-14808 concerns the Prog Management System from PROG MIS, with an exposed sensitive-information vulnerability. Unauthenticated remote attackers can access a specific page and obtain the database account and password, leading to high-impact confidentiality and integrity risks (CVSS ~9.3–9....

PT-2026-55877

Prog Management System developed by PROG MIS has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents...

The vulnerability of the DLS component in the OpenSearch software package allows a intruder to gain unauthorized access to protected information.

The vulnerability of the DLS component in the OpenSearch software package is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the Python PandasAI library, related to the lack of protective measures for SQL query structures, allows attackers to gain access to and read arbitrary files.

The vulnerability of the Python PandasAI library is related to the lack of protective measures for SQL query structures. Exploiting this vulnerability can allow an attacker operating remotely to gain read access to arbitrary files...

The vulnerability of the Production component in terms of technical maintenance, repairs, and major overhauls of Oracle Complex Maintenance, Repair, and Overhaul systems—the automation system for enterprise business activities within the Oracle E-Business Suite—allows a perpetrator to gain full control over the application.

The vulnerability of the Production component in terms of technical maintenance, repairs, and major overhauls of Oracle Complex Maintenance, Repair, and Overhaul systems related to Oracle E-Business Suite applications is related to deficiencies in access control. Exploiting this vulnerability cou...

The vulnerability of the TLS certificate validation module in the OpenSearch software package allows a hacker to circumvent existing security restrictions.

The vulnerability of the TLS certificate validation module in the OpenSearch software package is related to errors in the certificate authentication process. Exploiting this vulnerability could allow a malicious actor to circumvent existing security restrictions remotely...

Path Traversal

LaunchServer is vulnerable to path traversal. The vulnerability is due to insufficient validation of file path traversal sequences in the HTTP file server FileServerHandler, which allows an unauthenticated remote attacker to read arbitrary files, obtain sensitive server secrets including signing...

EUVD-2025-210413

picklescan before 0.0.33 fails to detect malicious pickle files using numpy.f2py.crackfortran.parameval function in reduce methods, allowing attackers to bypass security checks. Remote attackers can embed undetected code in pickle files that executes during deserialization, enabling arbitrary cod...