91142 matches found
GHSA-7JXH-36Q5-GCQV vulnerabilities
Vulnerabilities for packages: k8sgpt, tigera-operator, eksctl, kube-arangodb, steampipe, helm, k8ssandra-client, fuse-overlayfs-snapshotter, datadog-agent, syft, helm-mapkubeapis, chartmuseum, helm-push, wolfictl, xeol, helm-operator, neuvector-scanner, kaniko, zarf, spegel, dagger, gatekeeper,...
agent-bom v0.104.0
Open security scanner and self-hosted control plane for AI, MCP, and cloud infrastructure. Quick start · Self-host · Deployment models · Product tour · Docs For security, AppSec and GRC teams: discover AI agents, MCP servers, packages, credential references and infrastructure across repositories,...
EUVD-2026-75800
IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to execute arbitrary code due to an incomplete denylist in the security scanner...
EUVD-2026-75801
IBM Langflow OSS 1.0.0 through 1.11.5 An attacker who could submit custom component source code could bypass the static security scanner by crafting an annotated class-body assignment that resolved to a dangerous callable through alias tracking; the resolved value was never checked against the...
CVE-2026-90453: URL Redirection to Untrusted Site
A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without validating it against the application's own origin. This allows an authenticated attacker to craft a request that causes another user's browser to be...
CVE-2026-62109: Improper Neutralization of Special Elements used in an SQL Command
Editor SQL Injection in Sky Addons for Elementor = 3.8.4 versions...
CVE-2026-87910: Improper Limitation of a Pathname to a Restricted Directory
When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was...
CVE-2026-81861: Insufficiently Protected Credentials
CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information and unauthorized access to RTU functionality...
CVE-2026-7863: Improper Neutralization of Special Elements used in an OS Command
Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Software allows OS Command Injection. This issue affects Pardus Software: before 1.0.5...
CVE-2026-3869: Incorrect Implementation of Authentication Algorithm
CWE-303 : Incorrect Implementation of Authentication Algorithm vulnerability exists that could cause loss of confidentiality, integrity and availability of the PLC provided an application project with a lower application level is running on the PLC...
CVE-2026-8301: Improper Neutralization of Special Elements used in an OS Command
Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection. This issue affects Pardus Boot Repair: before 1.0.8...
CVE-2026-82578: Improper Restriction of XML External Entity Reference
When XML batch processing is turned on and the XPath option is selected, the raw batch input goes through a default XPath/JAXP setup with no entity restrictions, so XXE injection can allow data exfiltration and denial-of-service attacks...
CVE-2026-78224: Improper Restriction of XML External Entity Reference
The XSLT Transformer Step builds a bare TransformerFactory without the proper security options set, so XXE injection can allow data exfiltration and denial-of-service attacks...
CVE-2026-62140: Authorization Bypass Through User-Controlled Key
Unauthenticated Insecure Direct Object References IDOR in Quiz And Survey Master = 11.2.5 versions...
CVE-2026-62138: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in Visual Composer Website Builder = 45.16.1 versions...
CVE-2026-62135: Missing Authorization
Unauthenticated Broken Access Control in Booktics = 1.0.24 versions...
CVE-2026-62136: Missing Authorization
Unauthenticated Broken Access Control in Flexible Quantity – Measurement Price Calculator for WooCommerce = 2.3.21 versions...
CVE-2026-62133: Cross-Site Request Forgery (CSRF)
Subscriber Cross Site Request Forgery CSRF in RTMKit = 2.1.5 versions...