299488 matches found
CVE-2026-82310
The apache-airflow-providers-fab package is vulnerable to insufficient session expiration when used with Airflow 3 and the FAB auth manager with Core API token authentication. The root cause is that while password authentication correctly rejects disabled accounts, the Core API continues to accep...
EUVD-2026-80318
Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cleanup compares the string identifier Flask-Login stores in the session against the user's integer database identifier, so the...
EUVD-2026-80301
In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: restore skb-dev on deaggregated frames rmnetmapdeaggregate allocates each sub-frame with allocskb and leaves skb-dev NULL. rmnetmapingresshandler assigns skb-dev = ep-egressdev only on the data path, but a M...
CVE-2026-27555
A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/getioddportinfo endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device...
CVE-2026-27548
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/getioddportinfo endpoint using user or operator credentials allowing execution of commands with root privileges on the device...
CVE-2026-27553
A low-privileged remote attacker can manipulate the schema path parameter in the /index.php/diagnosticstab/ajaxdiagtablerows endpoint using a valid user cookie allowing disclosure of all user password hashes...
CVE-2026-27551
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/parameterManage endpoint using user credentials allowing execution of commands with root privileges on the device...
CVE-2026-73439 Security Advisory 0164
On affected platforms running Arista EOS, if OpenConfig is configured and running a gNMI server on the system, and if gNSI Pathz is configured and a gNSI Pathz policy is present on the system, then gNMI may fail to correctly enforce the rules in this policy if both a group rule and a user rule fo...
CVE-2026-27559 Command Injection via GET in /api/status/data
A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credentials allowing execution of commands with root privileges on the device...
CVE-2026-27555 Local File Inclusion in /index.php/ajax/get_iodd_port_info
A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/getioddportinfo endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device...
CVE-2026-27555 Local File Inclusion in /index.php/ajax/get_iodd_port_info
A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/getioddportinfo endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device...
EUVD-2026-80238
A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/getioddportinfo endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device...
CVE-2026-27553 Information Disclosure via Schema Path Manipulation
A low-privileged remote attacker can manipulate the schema path parameter in the /index.php/diagnosticstab/ajaxdiagtablerows endpoint using a valid user cookie allowing disclosure of all user password hashes...
CVE-2026-27551 Command Injection in /index.php/ajax/parameterManage
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/parameterManage endpoint using user credentials allowing execution of commands with root privileges on the device...
CVE-2026-27548 Command Injection in /index.php/ajax/get_iodd_port_info
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/getioddportinfo endpoint using user or operator credentials allowing execution of commands with root privileges on the device...
CVE-2026-27548 Command Injection in /index.php/ajax/get_iodd_port_info
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/getioddportinfo endpoint using user or operator credentials allowing execution of commands with root privileges on the device...
CVE-2026-27547 Command Injection in /index.php/ajax/get_iodd_menu_info
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/getioddmenuinfo endpoint using valid user or operator credentials allowing execution of commands with root privileges on the device...
CVE-2026-78252
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user could have induced a targeted user to perform unintended state-changing HTTP requests due to improper...
CVE-2026-19619
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to execute arbitrary JavaScript in the context of a targeted user's session due to...
CVE-2024-11222
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed a developer user to perform actions in the context of another user's merge request commit due to a race...