4211 matches found
CVE-2026-52130
llama.cpp b5693 and before is vulnerable to Uncontrolled Recursion in common/json-schema-to-grammar.cpp, resulting in a denial of service...
CVE-2026-81523
A flaw was found in libmongocrypt. A missing input validation vulnerability in the automatic-encryption context setup allows a caller-supplied database identifier to be accepted without proper sanitization. This can lead to incorrect schema selection, potentially resulting in limited disclosure o...
CVE-2026-52130
llama.cpp versions b5693 and before are affected by an Uncontrolled Recursion vulnerability in common/json-schema-to-grammar.cpp , leading to denial of service . The CVSS 3.1 score is 7.5 (HIGH) , with a network attack vector requiring no authentication or user interaction, impacting only availab...
CVE-2026-52130
llama.cpp b5693 and before is vulnerable to Uncontrolled Recursion in common/json-schema-to-grammar.cpp, resulting in a denial of service...
AlmaLinux 9 : mysql:8.4 (ALSA-2026:56973)
The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:56973 advisory. mysql: Performance Schema unspecified vulnerability CPU Jul 2026 CVE-2026-61081 mysql: Optimizer unspecified vulnerability CPU Jul 2026 CVE-2026-47064...
EUVD-2026-69412
llama.cpp b5693 and before is vulnerable to Uncontrolled Recursion in common/json-schema-to-grammar.cpp, resulting in a denial of service...
PT-2026-84506
Name of the Vulnerable Software and Affected Versions joi versions 16.0.0 through 17.13.5 joi versions 18.0.0 through 18.2.4 @hapi/joi versions 16.0.0 through 17.1.1 Description A prototype pollution issue exists in lib/messages.js where the exports.compile and exports.merge functions reuse...
CVE-2026-82874
ToolJet before v3.16.208 fails to validate that authenticated users belong to the organization specified in the organizationId path parameter of tooljet-db endpoints, allowing any Builder user to read, modify, and delete tables across tenant boundaries. Attackers can extract victim organization I...
CVE-2026-82868
@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts, event handlers, or foreignObject elements to execute...
CVE-2026-82874 ToolJet before v3.16.208 Cross-Tenant Authorization Bypass via tooljet-db
ToolJet before v3.16.208 fails to validate that authenticated users belong to the organization specified in the organizationId path parameter of tooljet-db endpoints, allowing any Builder user to read, modify, and delete tables across tenant boundaries. Attackers can extract victim organization I...
CVE-2026-82874
ToolJet before v3.16.208 suffers from a cross-tenant authorization bypass in its tooljet-db endpoints. The vulnerability stems from a failure to validate that an authenticated user belongs to the organization specified in the organizationId path parameter. This allows any Builder-level user to re...
CVE-2026-82873
ToolJet through 3.0.0-ee-beta.2 contains authorization bypass vulnerabilities in the POST /api/v2/resources/export endpoint. Authenticated attackers can supply a body-provided organization_id parameter to disclose TooljetDB table schemas across workspace boundaries, or bypass per-app authorizatio...
EUVD-2026-68408
ToolJet through 3.0.0-ee-beta.2 contains authorization bypass vulnerabilities in the POST /api/v2/resources/export endpoint that allow authenticated users to disclose TooljetDB table schemas across workspace boundaries and export app definitions across granular permission boundaries. Attackers ca...
CVE-2026-82873 ToolJet through 3.0.0-ee-beta.2 Cross-workspace Schema Disclosure via Export
ToolJet through 3.0.0-ee-beta.2 contains authorization bypass vulnerabilities in the POST /api/v2/resources/export endpoint that allow authenticated users to disclose TooljetDB table schemas across workspace boundaries and export app definitions across granular permission boundaries. Attackers ca...
CVE-2026-82871 ToolJet before v3.16.208 Cross-Organization Data Read via Database Routes
ToolJet before v3.16.208 fails to validate organization membership in database read routes, allowing any authenticated user to access other organizations' table schemas and row data. Attackers can supply arbitrary organization IDs in URL parameters to list tables, retrieve column definitions, and...
EUVD-2026-68402
@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sanitize option values before interpolating them into HTML via innerHTML. Attackers can supply malicious templates with crafted option values containing HTML and JavaScript to execu...
PT-2026-83750
Name of the Vulnerable Software and Affected Versions ToolJet versions prior to 3.0.0-ee-beta.2 Description An authorization bypass exists in the 'POST /api/v2/resources/export' endpoint. Authenticated users can disclose TooljetDB table schemas across workspace boundaries or export app definition...
PT-2026-83744
@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sanitize option values before interpolating them into HTML via innerHTML. Attackers can supply malicious templates with crafted option values containing HTML and JavaScript to execu...
Linux Distros Unpatched Vulnerability : CVE-2023-54354
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nokogiri before 1.14.3 CRuby implementation only, when using the packaged libxml2 bundles libxml2 v2.10.3, which is vulnerable to NULL pointer dereferences in X...
Linux Distros Unpatched Vulnerability : CVE-2025-71346
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nokogiri before 1.18.8 packages a vulnerable version of libxml2 before 2.13.8 that contains a heap-based buffer under-read CVE-2025-32415 in the...