9817 matches found
The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge web browsers allows attackers to access confidential data.
The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge is related to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...
The vulnerability of the Codecs components in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.
The vulnerability of the Codecs components in Google Chrome and Microsoft Edge relates to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...
OS Command Injection
com.powsybl, powsybl-computation-local is vulnerable to OS command injection. The vulnerability is due to insufficient escaping of attacker-controlled command arguments and environment variables before they are passed to shell interpreters, which allows an attacker to inject and execute arbitrary...
GHSA-JQVF-J3WW-R8C7 PowSyBl Core has Command Injection in LocalCommandExecutor-s
Impact Description Both AbstractLocalCommandExecutor OS-dependent implementations are subject to CWE-78 OS Command Injection, with a secondary CWE-88 Argument Injection concern via environment variables. The local command executor build command strings via concatenation and executes them through...
CVE-2025-30156
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the CephX authentication protocol encrypts tickets with AES-128-CBC in an unauthenticated mode that uses a hard-coded initialization vector and no message...
Uncontrolled Search Path Element
Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to Uncontrolled Search Path Element through the bundled xmllint tool in the underlying dependency. An attacker can potentially influence the search path used for external libraries ...
JetBrains TeamCity < 2021.2.3 Multiple Vulnerabilities
The version of JetBrains TeamCity installed on the remote host is prior to 2021.2.3. It is, therefore, affected by multiple vulnerabilities: - JetBrains TeamCity before 2021.2.3 was vulnerable to OS command injection in the Agent Push feature configuration. CVE-2022-25263 - In JetBrains TeamCity...
JetBrains TeamCity < 2022.04.4 (CVE-2022-40979)
The version of JetBrains TeamCity installed on the remote host is prior to 2022.04.4. It is, therefore, affected by a vulnerability: - In JetBrains TeamCity before 2022.04.4 environmental variables of password type could be logged when using custom Perforce executable CVE-2022-40979 Note that...
Security Bulletin: Langflow is affected by weaknesses in secret handling and sensitive configuration access
Summary Langflow includes features for secret protection, environment access, and runtime configuration of workflow components. Weaknesses in cryptographic key handling, exposure of process environment values, and insufficient restriction of sensitive runtime configuration fields could allow...
CVE-2026-68518
A flaw was found in Glances, an open-source system monitoring tool. This vulnerability allows an attacker to bypass input sanitization by using adjacent unescaped Mustache variables. When an administrator-configured action template renders attacker-controlled process or container fields, these...
CVE-2026-53541 OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input Filtering
OliveTin gives access to predefined shell commands from a web interface. The filterToDefinedArgumentsOnly function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, prior to commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d, a specia...
CVE-2026-53541
OliveTin gives access to predefined shell commands from a web interface. The "filterToDefinedArgumentsOnly" function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, prior to commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d, a...
CVE-2026-53541 OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input Filtering
OliveTin gives access to predefined shell commands from a web interface. The filterToDefinedArgumentsOnly function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, prior to commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d, a specia...
MAL-2026-14355 Malicious code in fuel-react (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e35f4772b8cba3555519c250662c67395bf57d89feed3feba7ea067b6bb2c27 The package's postinstall.js script executes automatically on npm install and collects host identity plus environment variables os.hostname,...
CVE-2026-71494 Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname
Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remotevariablesloader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination...
SUSE-SU-2026:23249-1 Security update for openssh
This update for openssh fixes the following issues: - CVE-2025-32728: fix logic error in DisableForwarding option bsc1241012. - CVE-2026-3497: information disclosure or denial of service due to uninitialized variables bsc1259642. - CVE-2026-35385: a file downloaded by scp may be installed setuid ...
MAL-2026-14342 Malicious code in coin-fees (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f47c61fd59fb65dc8c8932e3e913dd83f18fc8af1d5f06b03cae327228821703 package.json declares a postinstall hook that runs index.js on every install. The script hex-decodes and concatenates a hardcoded destination hostnam...
CVE-2026-53541: Improper Input Validation
OliveTin gives access to predefined shell commands from a web interface. The filterToDefinedArgumentsOnly function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, prior to commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d, a specia...
PT-2026-79415
Name of the Vulnerable Software and Affected Versions Infracost versions prior to 0.10.45 Description Infracost allows the attachment of a configured Terraform Cloud or registry token to a destination hostname derived from untrusted Terraform input without verifying if the host is trusted. This...
