604034 matches found
EUVD-2026-63093
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Telephony Service allows an authorized attacker to elevate privileges locally...
OpenJDK: Improve Resource Resolving (2026-08 Security Update)
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12;...
CVE-2026-76827
A flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed search data. This is possible because the delta-sync write paths in search-indexer do not properly restrict UPDATE/DELETE operations to...
CVE-2026-54491
Koel versions prior to 9.7.1 contain an authenticated SSRF: any low-privilege user can supply a URL that 302-redirects to internal addresses or cloud metadata IPs (e.g., 169.254.169.254), since isPublicHost()/isSafeUrl() checks are point-in-time with no IP pinning and per-hop redirect validation ...
CVE-2026-54491 Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch paths
Koel is a free, open-source music streaming solution. Prior to 9.7.1, outbound podcast and radio fetch paths perform a point-in-time App\Helpers\Network::isPublicHost or isSafeUrl check without pinning the validated address, and most paths lack redirect-hop validation and do not revalidate every...
CVE-2026-54493 Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations
Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createInternetRadioStation.view and updateInternetRadioStation.view routes accept an authenticated user's streamUrl without the SafeUrl and HasAudioContentType checks used by the regular radio API...
CVE-2026-54494 Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv6-transition wrappers of internal IPv4
Koel is a free, open-source music streaming solution. Prior to 9.7.1, App\Helpers\Network::isPublicHost uses filtervar with FILTERFLAGNOPRIVRANGE and FILTERFLAGNORESRANGE, which treats NAT64 64:ff9b::/96 and 6to4 2002::/16 wrappers of private, loopback, or link-local IPv4 addresses as public. An...
CVE-2026-68553 Coturn: Format String Injection via TURN USERNAME/REALM into hiredis Redis Command
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, an authenticated TURN user can place printf-style format specifiers in the STUN USERNAME or REALM attribute, which passes issecurestring validation and is embedded into Redis keys at nine call sites in...
CVE-2026-12634 Out-of-bounds stack write in the settings NVS backend from over-reported nvs_read length
The NVS backend of the Zephyr settings subsystem subsys/settings/src/settingsnvs.c reads stored setting-name entries into fixed 74-byte stack buffers and NUL-terminates them with bufrc = '\0', where rc is the return value of nvsread. Per its contract, nvsread returns the full stored entry length...
EUVD-2026-62859
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the terminal WebSocket accepts a user-controlled hostConfig.id and src/backend/ssh/host-resolver.ts resolves that host without requiring ownership or explicit access. When...
CVE-2026-53546 Termix: Missing authorization in SSH host credential resolution exposes stored credentials
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the terminal WebSocket accepts a user-controlled hostConfig.id and src/backend/ssh/host-resolver.ts resolves that host without requiring ownership or explicit access. When...
CVE-2026-53546 Termix: Missing authorization in SSH host credential resolution exposes stored credentials
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the terminal WebSocket accepts a user-controlled hostConfig.id and src/backend/ssh/host-resolver.ts resolves that host without requiring ownership or explicit access. When...
CVE-2026-53546
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing. Prior to 2.3.2 , the terminal WebSocket accepts a user-controlled hostConfig.id, and src/backend/ssh/host-resolver.ts resolves that host without requiring ownership or explicit access . When no creden...
EUVD-2026-62857
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.6.1, the GET /host/db/host/:id/password endpoint in src/backend/database/routes/host.ts accepts an authenticated user's numeric host ID and the field=password or...
CVE-2026-55703
creationtimestamp| type| source ---|---|--- 2026-08-19 20:35:05+00:00| published-proof-of-concept| https://github.com/grokability/snipe-it/security/advisories/GHSA-r9r3-g9fp-3q4q...
CVE-2026-53549
An authenticated low-privileged user can exploit the unvalidated POST /host/db/proxy/test endpoint to probe internal hosts, metadata services, and cloud credentials; fixed in Termix 2.3.2. No exploitation evidence provided in the documents.
EUVD-2026-62854
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service and obtain sensitive information due to an out-of-bounds read...
CVE-2026-18102 IBM i Buffer Overflow
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to overwrite adjacent memory due to an integer underflow during bounds checking...
CVE-2026-54738 Lemmy: Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfo
Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, actix-web ConnectionInfo::realipremoteaddr reads the first value of X-Forwarded-For as the client address used by rawipkey in crates/utils/src/ratelimit/mod.rs. Lemmy's bundled docker/nginx.conf uses...
