github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint

A flaw was found in Prometheus. An unauthenticated attacker can exploit the remote read endpoint /api/v1/read by sending a specially crafted, small snappy-compressed payload. This payload causes a disproportionately large memory allocation, leading to memory exhaustion and a Denial of Service DoS...

CVE-2026-58231

SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high...

CVE-2026-72606 Pinry Pinry - Server-Side Request Forgery

A server-side request forgery vulnerability in Pinry through 2.1.13 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the pin-from-URL feature. The feature passes the user-supplied URL directly to requests.get without host o...

CVE-2026-72606

A server-side request forgery vulnerability in Pinry through 2.1.13 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the pin-from-URL feature. The feature passes the user-supplied URL directly to requests.get without host o...

CVE-2026-72605 Swing Music Swing Music - Missing Authentication

A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profile/create endpoint. The endpoint is allowlisted from JWT verification, permitting unauthenticated account creation. An attacker can registe...

CVE-2026-72605

The CVE-2026-72605 entry concerns Swing Music 3.0.0 with a missing authentication flaw: the POST /auth/profile/create endpoint is allowlisted from JWT verification, enabling unauthenticated remote attackers to create arbitrary user accounts. This can lead to attackers registering accounts and gai...

EUVD-2026-56044

A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profile/create endpoint. The endpoint is allowlisted from JWT verification, permitting unauthenticated account creation. An attacker can registe...

CVE-2026-72605

A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profile/create endpoint. The endpoint is allowlisted from JWT verification, permitting unauthenticated account creation. An attacker can registe...

CVE-2026-72602

CVE-2026-72602 affects AsyncFuncAI deepwiki-open. A path traversal flaw in the local-repository structure endpoint (through commit 16f35a0) allows unauthenticated remote attackers to obtain directory listings for arbitrary filesystem paths, since WIKI_AUTH_MODE defaults to false. This enables enu...

CVE-2026-72602 AsyncFuncAI deepwiki-open - Path Traversal

A path traversal vulnerability in AsyncFuncAI deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to obtain directory listings for arbitrary filesystem paths via the local-repository structure endpoint. The endpoint accepts an absolute filesystem path parameter and return...

CVE-2026-72602

A path traversal vulnerability in AsyncFuncAI deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to obtain directory listings for arbitrary filesystem paths via the local-repository structure endpoint. The endpoint accepts an absolute filesystem path parameter and return...

EUVD-2026-56040

A broken access control vulnerability in CSZ CMS 1.3.2 allows unauthenticated remote attackers to read all form submissions including personally identifiable information via the admin form-submission viewer. The viewer endpoint lacks an authentication check and the framework authentication helper...

CVE-2026-72601

CSZ CMS 1.3.2 is affected by a Broken Access Control vulnerability that allows unauthenticated remote attackers to read all form submissions, including PII, via the admin form-submission viewer. The viewer endpoint does not perform authentication and the framework authentication helper fails open...

CVE-2026-72601 CSZ CMS CSZ CMS - Broken Access Control

A broken access control vulnerability in CSZ CMS 1.3.2 allows unauthenticated remote attackers to read all form submissions including personally identifiable information via the admin form-submission viewer. The viewer endpoint lacks an authentication check and the framework authentication helper...

EUVD-2026-56039

A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer PII via the /download router. The router is mounted without authentication middleware, making it publicly accessible. An attacker can...

CVE-2026-72600

A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer PII via the /download router. The router is mounted without authentication middleware, making it publicly accessible. An attacker can...

CVE-2026-72600 Idurar IDURAR ERP CRM - Broken Access Control

A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer PII via the /download router. The router is mounted without authentication middleware, making it publicly accessible. An attacker can...

CVE-2026-72600 Idurar IDURAR ERP CRM - Broken Access Control

A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer PII via the /download router. The router is mounted without authentication middleware, making it publicly accessible. An attacker can...

CVE-2026-72600

Idurar IDURAR ERP CRM 4.1.0 contains a broken access control vulnerability that allows unauthenticated remote attackers to download invoice PDFs containing customer PII via the /download route. The router is mounted without authentication middleware, enabling public access, and an attacker can en...

CVE-2026-72552

A server-side request forgery vulnerability in Dub as of 2026-07-10 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the metatags edge endpoint. The endpoint fetches any caller-supplied URL without applying a denylist or...