32336 matches found
CVE-2026-106445 vulnerabilities
Vulnerabilities for packages: nextcloud-server, prism, rancher-api-ui, renovate, tileserver-gl, lerna, opensearch-dashboards, ts-patch...
CVE-2026-106444 vulnerabilities
Vulnerabilities for packages: nextcloud-server, prism, rancher-api-ui, renovate, tileserver-gl, lerna, opensearch-dashboards, ts-patch...
GHSA-XW65-4HP5-5HC7 vulnerabilities
Vulnerabilities for packages: nextcloud-server, prism, rancher-api-ui, renovate, tileserver-gl, lerna, opensearch-dashboards, ts-patch...
GO-2026-6609 vulnerabilities
Vulnerabilities for packages: prometheus-adapter, temporal-ui-server, cloudprober, kyverno-policy-reporter-ui, kubernetes, kube-arangodb, rancher, opencost, spire-server, cert-manager-webhook-pdns, zarf, external-dns, juicefs, k8s-device-plugin, flux, grafana-pyroscope, hubble-ui, grafana-alloy,...
GHSA-F4XW-M386-M277 vulnerabilities
Vulnerabilities for packages: prometheus-adapter, temporal-ui-server, cloudprober, kyverno-policy-reporter-ui, kubernetes, kube-arangodb, rancher, opencost, spire-server, cert-manager-webhook-pdns, zarf, external-dns, juicefs, k8s-device-plugin, flux, grafana-pyroscope, hubble-ui, grafana-alloy,...
neo
Neo Trasforma qualsiasi app web in un'API. Non serve un'API ufficiale. Nessuna automazione del browser. Neo è un'estensione Chrome che cattura passivamente ogni chiamata API che il tuo browser effettua, impara gli schemi e permette all'AI o a te di riprodurle direttamente. Il problema Gli agenti ...
Exploit for CVE-2026-107806
CVE-2026-107806 — nginx-ui authenticated RCE backup restore...
strelka-ui
Releasesrelease | Pull Requestspr | Issuesissues !GitHub releaseimg-version-badgerepo !Build Statusimg-actions-badgeactions-ci !Pull Requestsimg-pr-badgepr !Slackimg-slack-badgeslack !Licenseimg-license-badgelicense La Strelka Web UI è un frontend per l'invio di file basato su browser e API per l...
CLEANSTART-2026-UV14417 Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI
Security vulnerability affects the airflow-3 package. Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI...
CLEANSTART-2026-WT65883 bug in Apache Airflow's `/ui/dependencies` scheduling graph endpoint applied the caller's readable-Dag filter to the top-level serialized Dag key but still emitted referenced Dag IDs through the `dep
Security vulnerability affects the airflow-3 package. A bug in Apache Airflow's /ui/dependencies scheduling graph endpoint applied the caller's readable-Dag filter to the top-level serialized Dag key but still emitted referenced Dag IDs through the dep...
PT-2026-114460
Уязвимость пользовательского интерфейса Nginx UI сервера nginx связана с неверным управлением генерацией кода. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, выполнить произвольный код...
PT-2026-109637
Name of the Vulnerable Software and Affected Versions Kendo UI for Vue @progress/kendo-vue-charts versions 2.5.0 through 16.1.0 Description The default Chart tooltip renders formatted point values as raw HTML without encoding in both single-point and shared tooltips. An attacker with low privileg...
Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage
Summary In Nginx UI versions 2.5.0 through 2.5.x, the node-signature authentication path staged an attacker-controlled request body in a temporary file and synchronized it to disk before validating the body digest and cryptographic signature. An unauthenticated remote client that can reach the AP...
GHSA-J3HG-9RP3-5HW9 Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage
Summary In Nginx UI versions 2.5.0 through 2.5.x, the node-signature authentication path staged an attacker-controlled request body in a temporary file and synchronized it to disk before validating the body digest and cryptographic signature. An unauthenticated remote client that can reach the AP...
GHSA-9H23-53F4-Q947 Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout
Summary In Nginx UI versions 2.2.0 through 2.5.x, the official bundled reverse-proxy topology did not preserve the external client identity used by Gin. The backend treated the local proxy peer as the client because no trusted proxy was configured, while the proxy supplied the actual address in...
Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout
Summary In Nginx UI versions 2.2.0 through 2.5.x, the official bundled reverse-proxy topology did not preserve the external client identity used by Gin. The backend treated the local proxy peer as the client because no trusted proxy was configured, while the proxy supplied the actual address in...
Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite
Summary An authenticated nginx-ui user can call POST /api/restore, upload a forged encrypted backup, restore app.ini, set nginx command settings such as TestConfigCmd, and then trigger command execution with POST /api/nginx/test. This was validated on nginx-ui 2.3.11 2523 6c86e5a5 in the local...
GHSA-P393-CF76-4JMR Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite
Summary An authenticated nginx-ui user can call POST /api/restore, upload a forged encrypted backup, restore app.ini, set nginx command settings such as TestConfigCmd, and then trigger command execution with POST /api/nginx/test. This was validated on nginx-ui 2.3.11 2523 6c86e5a5 in the local...
Malicious Package
Overview @tvg-mar/tvg-promos-atomic-ui is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
