205952 matches found
PT-2026-106243
In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation...
PT-2026-106223
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A build step for a Git source can be crafted to bypass certain policy validation rules. This allows a malicious build definition to misrepresent the remote URL o...
CVE-2026-93322: Improper Validation of Array Index
A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon...
CVE-2026-93317: Improper Validation of Integrity Check Value
An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The resulting snapshot could be cached under that digest and reused by a later victim build, compromising build-input integrity...
CVE-2026-101919: Improper Input Validation
A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration kubeconfig secrets directly into the privileged control plane namespace without proper validation or sanitization. An authenticated user with cluster and secret creation permissions can exploit...
CVE-2026-105292: Cross-Site Request Forgery (CSRF)
Chaterm before 0.12.1 contains a login cross-site request forgery vulnerability that allows remote attackers to inject login state by sending chaterm:// callbacks without OAuth state validation. Attackers can trigger a crafted callback with attacker-controlled userInfo from a web page, signing th...
CVE-2026-105223: Improper Certificate Validation
maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconfig and parseKubeconfigFile when a kubeconfig lacks certificate-authority-data, ignoring insecure-skip-tls-verify. On-path attackers can impersonate the Kubernetes API server to capture Bearer token...
CVE-2026-58834: Improper Input Validation
In setPermissionGrantState of DevicePolicyManagerService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-79820: Improper Authentication
A remote user validation failure vulnerability exists in HPE Integrated Lights-Out iLO 7 firmware...
CVE-2026-105754: Improper Input Validation
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the /inference/v1/generate endpoint in the disaggregated scale-out path accepts caller-supplied tensors in the features.kwargsdata field, cache identifiers in the features.mmhashes field, ranges in the...
CVE-2026-93321: Improper Validation of Array Index
A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon...
CVE-2026-105681: Improper Neutralization of Special Elements in Data Query Logic
Ghost is a Node.js content management system. From 5.9.0 until 6.44.1, an input validation issue allowed members to access comments they were not authorized to access. This issue is fixed in version 6.44.1...
CVE-2026-105648: Incomplete List of Disallowed Inputs
Ghost is a Node.js content management system. From 6.0.9 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network on some network configurations. A...
CVE-2026-93326: Incorrect Behavior Order: Validate Before Canonicalize
A build step for a Git source, crafted in a specific way, can bypass some policy validation rules. A malicious build definition can make the repository look like it is coming from a different remote URL than it really is when Git clone is happening. If policy is doing more stricter validation, fo...
Apple iOS, iPadOS, and macOS Certificate Validation
Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS contain a certificate validation issue that could allow an attacker with a compromised intermediate certificate authority to issue certificates with arbitrary extended key usages...
PT-2026-104666
Chaterm before 0.12.1 contains a login cross-site request forgery vulnerability that allows remote attackers to inject login state by sending chaterm:// callbacks without OAuth state validation. Attackers can trigger a crafted callback with attacker-controlled userInfo from a web page, signing th...
CVE-2026-105773: Concurrent Execution using Shared Resource with Improper Synchronization
Canimaan Software ClamXAV versions 3.3 - 3.11 contains a local privilege escalation vulnerability in the Privileged Helper Tool caused by a race condition and insufficient file validation, allowing a local attacker to execute arbitrary code with system privileges. Fixed in 3.11.1...
ROS-20261005-73-0133
The vulnerability of the kawethprobe function in the drivers/net/usb/kaweth.c module of the Linux USB network adapter driver framework is related to improper validation of consistency checks in input data. Exploiting this vulnerability could allow an attacker to cause service failures...
PT-2026-106238
Name of the Vulnerable Software and Affected Versions Canimaan Software ClamXAV versions 3.3 through 3.11 Description A local privilege escalation issue exists in the Privileged Helper Tool. This is caused by a race condition and insufficient file validation, which allows a local attacker to...
PT-2026-106158
In setPermissionGrantState of DevicePolicyManagerService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...