RCE (Remote Code Execution) uuid Dependency in Bamboo Data Center

This High severity RCE Remote Code Execution vulnerability was introduced in versions 10.0.0, 10.1.0 and 10.2.0 of Bamboo Data Center. This RCE Remote Code Execution vulnerability, with a CVSS Score of 8.1 and a CVSS Vector of CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U...

Malicious code in forge-gas-diff (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b1f6143f5a7c6106ab4ba0a21a6adaf9020e332835b1e528de6f36b64537734 index.js is advertised as a Foundry gas-report diff utility but on module load / CLI run schedules a setTimeout of 259,200,000 ms 3 days that calls...

Malicious code in gas-diff-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f6244035d2e65cd84c001ff936ebc019b7139c8e2afadfadfd2026c60208e4b On require, index.js runs an IIFE that persists an install timestamp and UUID under /.forge/gas-diff.json. After 72 hours have elapsed since first...

PT-2026-75941

Impact When a Nuxt dev server is bound to a network-reachable interface for example nuxt dev --host for on-device testing, the default-enabled Chrome DevTools workspace endpoint GET /.well-known/appspecific/com.chrome.devtools.json returns the absolute project root workspace.root, i.e. rootDir an...

CVE-2026-47364: Exposure of Sensitive Information to an Unauthorized Actor

In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user-facing opt-out. Impact: The Datadog user UUID and crash data are visible within Firebase Crashlytics. This UUID is not identifying outside Datadog's own...

CVE-2026-48169: Authorization Bypass Through User-Controlled Key

PraisonAI is a multi-agent teams system. Versions prior to 0.1.4 of the PraisonAI Platform API have two authorization failures that together break workspace isolation. The service layer for issues and projects performs global primary-key lookups without checking workspace ownership, so any...

CVE-2026-67622

Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID to Assistants endpoints without workspace ownersh...

ROOT-APP-NPM-GHSA-W5HQ-G745-H8PQ GHSA-w5hq-g745-h8pq in uuid - Patched by Root

Root has patched GHSA-w5hq-g745-h8pq in the uuid package for Root:npm. Multiple fixed versions available...

CLSA-2026-1777509596 TuxCare security update for uuid (1 CVE)

TuxCare rebuilt uuid to address 1 CVE. Fixed in 3.4.0-tuxcare.1...

PT-2026-75129

TuxCare rebuilt uuid to address 2 CVEs. Fixed in 8.3.2-tuxcare.2...

PT-2026-75131

TuxCare rebuilt uuid to address 2 CVEs. Fixed in 3.4.0-tuxcare.2...

PT-2026-73864

TuxCare rebuilt node-uuid to address 1 CVE. Fixed in 1.4.3-tuxcare.1...

PT-2026-74757

TuxCare rebuilt uuid to address 1 CVE. Fixed in 9.0.1-tuxcare.1...

PT-2026-75128

TuxCare rebuilt uuid to address 2 CVEs. Fixed in 9.0.1-tuxcare.2...

PT-2026-74756

TuxCare rebuilt uuid to address 2 CVEs. Fixed in 11.0.5-tuxcare.1...

PT-2026-74644

TuxCare rebuilt uuid to address 1 CVE. Fixed in 3.4.0-tuxcare.1...

PT-2026-74773

TuxCare rebuilt uuid to address 1 CVE. Fixed in 8.3.2-tuxcare.1...

CVE-2026-69094 Admidio before 5.0.11 IDOR via save_temporary mylist_function.php

Admidio before 5.0.11 contains an insecure direct object reference vulnerability in the savetemporary mode of mylistfunction.php that allows authenticated users to hijack list configurations. Attackers can enumerate global list UUIDs and overwrite admin-curated global lists or other users' privat...

SUSE CVE-2026-42300

DevGuard provides vulnerability management for the full software supply chain. Prior to 1.2.2, the SessionMiddleware accepts a client-supplied X-Admin-Token HTTP request header and uses its raw string value as the authenticated userID when no Kratos session cookie is present. An unauthenticated...

SUSE CVE-2026-55428

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the tailnet coordinator validates that an agent's Addresses derive from its authenticated UUID but applies no equivalent check to AllowedIPs. The coordinato...