CVE-2026-64206 vulnerabilities

Vulnerabilities for packages: linux-gcp...

CVE-2026-64267 vulnerabilities

Vulnerabilities for packages: linux-gcp...

GHSA-694X-MWH7-5PVF vulnerabilities

Vulnerabilities for packages: linux-gcp...

GHSA-JGV4-5FJV-3XP7 vulnerabilities

Vulnerabilities for packages: consul-fips...

GHSA-27M6-255M-6Q58 vulnerabilities

Vulnerabilities for packages: consul-fips...

CVE-2026-15970 vulnerabilities

Vulnerabilities for packages: consul-fips...

GHSA-JGRX-MGXX-JF9V vulnerabilities

Vulnerabilities for packages: arangodb...

CVE-2021-3777 vulnerabilities

Vulnerabilities for packages: arangodb...

CVE-2026-41706 vulnerabilities

Vulnerabilities for packages: geoserver, apache-nifi-registry...

GHSA-X2R2-RVHQ-2MQV vulnerabilities

Vulnerabilities for packages: geoserver, apache-nifi-registry...

EUVD-2026-58502

Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTEQUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials,...

EUVD-2026-58504

Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-level users to bypass DNS pinning protections through DNS rebinding attacks. Attackers can configure hostnames that resolve to public...

EUVD-2026-58503

Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in identifiers. Attackers with write permission on a table with a double-quote in its name can inject SQL that executes as the datasource's...

EUVD-2026-58478

AgenticSeek commit fc242c7 contains an unauthenticated remote code execution vulnerability that allows any network-adjacent attacker to execute arbitrary commands by submitting crafted queries to the unprotected POST /query API endpoint bound to 0.0.0.0:7777 with wildcard CORS. Attackers can send...

EUVD-2026-58547

filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is enabled with default CreateUserDir setting. Unauthenticated attackers can register accounts that inherit the server root scope with full create, modify, delete, rename, share, and download permissions...

EUVD-2026-58548

OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount configuration. Authenticated users with only the mount-configuration ACL group can append arbitrary cron entries via ubus file.write,...

PT-2026-72132

Name of the Vulnerable Software and Affected Versions Red Hat Quay affected versions not specified Description A Server-Side Request Forgery SSRF flaw exists within the build API. A user with repository write access and the FEATURE BUILD SUPPORT enabled can provide a malicious URL via the archive...

PT-2026-72128

Name of the Vulnerable Software and Affected Versions Red Hat Quay affected versions not specified Description An Insecure Direct Object Reference IDOR exists where a repository administrator can access notification configurations of other repositories by knowing or guessing the Universally Uniqu...

PT-2026-72055

A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could exploit this issue by supplying specially crafted input that is later processed unsafely during server-side report rendering, resulting in...

PT-2026-71985

go-chi chi versions = 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first leftmost value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log...