7861 matches found
GO-2026-6528 Perses's unvalidated project parameter enables filesystem path traversal in github.com/perses/perses
Perses's unvalidated project parameter enables filesystem path traversal in github.com/perses/perses...
WS-2026-0083
OpenBao before 2.6.3 / 2.7.0-beta: the PKI secrets engine's ACME order finalization only checked the DNS and IP identifiers in the submitted CSR against the order's validated identifiers, so other Subject Alternative Names such as email, URI or other SAN types were issued in the certificate witho...
EUVD-2026-88044
A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be...
CVE-2026-101057 utcp-mcp before 1.1.3 SSRF via unvalidated MCP server URL
utcp-mcp the MCP plugin of python-utcp through 1.1.2 connects to the HTTP and WebSocket MCP server URLs given in a call template's mcpServers configuration without the ensuresecureurl validation that the HTTP-family plugins apply, so the HTTPS/WSS-or-loopback rule is not enforced. A call template...
RLSA-2026:71608 Important: perl-DBI security update
The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent interface, meaning it defines a consistent set of methods, variables, and conventions for database operations. Security Fixes: perl-DBI: DBI for Perl: Heap...
perl-DBI security update
An update is available for perl-DBI. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The perl-DBI package provides the standard database interface module for the...
CVE-2026-100502 Flame through 2.4.0 Admin Token Insufficient Session Expiration
Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that...
perl-DBI security update
An update is available for perl-DBI. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The perl-DBI package provides the standard database interface module for the...
CVE-2026-56727 Zammad: PGP signature spoofing via unvalidated verification return
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary In Zammad's inbound PGP email processing, the return value of the gpg verification call was silently discarded. Regardless of whether gpg reported a valid, invalid, or missing signature, the handler...
CVE-2026-56727 Zammad: PGP signature spoofing via unvalidated verification return
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary In Zammad's inbound PGP email processing, the return value of the gpg verification call was silently discarded. Regardless of whether gpg reported a valid, invalid, or missing signature, the handler...
SUSE-SU-2026:23952-1 Security update for perl-DBI
This update for perl-DBI fixes the following issue: - CVE-2026-78030: arbitrary modules loaded due to unvalidated dbmtype and dbmmldbm attributes in DBD::DBM bsc1281704...
SUSE-SU-2026:23919-1 Security update for perl-DBI
This update for perl-DBI fixes the following issue: - CVE-2026-78030: arbitrary modules loaded due to unvalidated dbmtype and dbmmldbm attributes in DBD::DBM bsc1281704...
HAProxy DoS
The vulnerability of the server software HAProxy is related to an unvalidated return value. Exploiting this vulnerability could allow a malicious actor to cause service failures...
Kubernetes Helm Array Indexing
The vulnerability in the Kubernetes Helm package manager is related to unvalidated array indexing. Exploitation of this vulnerability may allow a remote attacker to compromise the confidentiality, integrity, and availability of protected information...
SUSE SLES12 Security Update : perl-DBI (SUSE-SU-2026:4346-1)
The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4346-1 advisory. This update for perl-DBI fixes the following issue: - CVE-2026-78030: arbitrary modules loaded due to unvalidated dbmtype and dbmmldbm...
ROS-20260925-73-0011
The vulnerability of the tuningctlset function in the sound subsystem of the Linux operating system is related to unvalidated array indexing. Exploiting this vulnerability could allow an attacker to access protected information or cause service failures...
RockyLinux 9 : perl-DBI (RLSA-2026:71422)
The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:71422 advisory. perl-DBI: DBI for Perl: Heap out-of-bounds write via unvalidated numeric placeholder CVE-2026-73194 Tenable has extracted the preceding description block directl...
CVE-2026-97636
Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the backend to resolve a secret...
EUVD-2026-51596
Contao: Server-Side Request Forgery SSRF via Unvalidated RSS Feed URL in Feed Reader Module...
GHSA-2JX3-FF3V-J7JJ yara-x: Unvalidated deserialization in safe `Rules::deserialize` allows memory corruption and UB
!NOTE This finding was identified during an agentic unsafe Rust code review performed by Gemini AI, followed by human review and verification. The Issue The crate exports a public safe API Rules::deserialize accepting any generic byte sequence B: AsRef. It restores compiled rule structures direct...