24192 matches found
CVE-2026-80428
This repository does not have a README...
Important: Red Hat Security Advisory: Red Hat AI Inference Server Model Optimization Tools 3.3.7 (CUDA)
Red Hat AI Inference Server Model Optimization Tools 3.3.7 CUDA is now available. Red Hat® AI Inference Server Model Optimization Tools...
CVE-2026-86862 pgAdmin 4: Connection-string injection via the database field in the Restore and Maintenance tools
pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbname option given to pgrestore and psql. libpq expands a database name containing an equals sign into a full connection string, and connection keywords embedded in that value tak...
@bymbly/api-tools (>=1.3.1, <=1.4.55), @fsco/autosync (>=0.2.12, <=0.3.1) +1 more potentially affected by CVE-2026-63225 via @redocly/cli (>=2.0.2, <=2.32.2)
@redocly/cli NPM version =2.0.2, =1.3.1, =0.2.12, =2.5.0, =3.11.1 Source cves: CVE-2026-63225 Source advisory: OSV:GHSA-657C-G7QC-R9J2...
Lab-001-Gitea-CVE-2026-20896-
Lab-001-Gitea-CVE-2026-20896-...
A Bootiful Podcast: Spring Tools lead Martin Lippert
Hi, Spring fans! In this conversation, Spring Tools lead Martin Lippert joins us for a fascinating look at how developer tooling has evolved from Eclipse to VS Code and beyond. We dig into the architecture behind Spring Tools, language servers, MCP, and how the same ideas that once helped...
CVE-2026-54648: Missing Authorization
CubeCart is an ecommerce software solution. Prior to 6.7.5, the GDPR tools in admin/sources/customers.gdpr.inc.php rely on page-level CCPERMREAD access and do not require CCPERMDELETE for the purge, noorderpurge, or deleteguests commands. An authenticated administrator with read-only customer...
CVE-2026-86862: Improper Neutralization of Argument Delimiters in a Command
pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbname option given to pgrestore and psql. libpq expands a database name containing an equals sign into a full connection string, and connection keywords embedded in that value tak...
CVE-2026-92795
Coze Studio through 0.5.1 fails to restrict the server URL supplied when registering plugin tools, allowing authenticated users to make the backend fetch internal services. Attackers can construct plugin requests to access cloud metadata endpoints and internal services reachable only from the...
EUVD-2026-81058
Coze Studio through 0.5.1 fails to restrict the server URL supplied when registering plugin tools, allowing authenticated users to make the backend fetch internal services. Attackers can construct plugin requests to access cloud metadata endpoints and internal services reachable only from the...
CVE-2026-92795
Coze Studio through 0.5.1 contains a Server-Side Request Forgery (SSRF) vulnerability in its plugin system. The root cause is a failure to restrict the server URL supplied when registering plugin tools, allowing authenticated users to craft plugin requests that make the backend fetch internal ser...
CVE-2026-92795 Coze Studio through 0.5.1 Server-Side Request Forgery via Plugin
Coze Studio through 0.5.1 fails to restrict the server URL supplied when registering plugin tools, allowing authenticated users to make the backend fetch internal services. Attackers can construct plugin requests to access cloud metadata endpoints and internal services reachable only from the...
AZL-103146 CVE-2026-81870 affecting package cri-tools 1.32.0-8
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration...
CVE-2026-5059-poc
¿Dónde está CVE-2026-5059 en el código? La vulnerabilidad está en dos archivos que trabajan juntos: Archivo 1: tools.py — La causa raíz La versión antigua usaba shell=True en executepipedcommand: root@kitploit: CÓDIGO ANTIGUO VULNERABLE process = subprocess.run command, ← cadena sin procesar pasa...
CVE-2026-20305
A vulnerability in the diagnostic tools of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must have valid administrative...
EUVD-2026-80885
A vulnerability in the diagnostic tools of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must have valid administrative...
CVE-2026-20305 Cisco Identity Services Engine Command Injection Vulnerability
A vulnerability in the diagnostic tools of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must have valid administrative...
CVE-2026-20305
A command injection vulnerability in the diagnostic tools of Cisco ISE and ISE-PIC allows an authenticated remote attacker with valid administrative credentials to send crafted commands via the web-based management interface. The root cause is improper validation of user-supplied input , leading ...
CVE-2026-20305 Cisco Identity Services Engine Command Injection Vulnerability
A vulnerability in the diagnostic tools of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must have valid administrative...