51287 matches found
mysql: DML unspecified vulnerability (CPU Apr 2026)
Oracle CPU describes the issue as following: Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DML. Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access v...
Security Bulletin: IBM Engineering Systems Design Rhapsody was affected by CVE-2026-1605
Summary Security Bulletin: IBM Engineering Systems Design Rhapsody was affected by CVE-2026-1605, CVE-2026-1605 is a high-severity vulnerability in the Eclipse Jetty web server caused by improper resource management in the GzipHandler component. IBM Engineering Systems Design Rhapsody has resolve...
@activepieces/piece-json (>=0.1.6, <=0.1.7), @autexis/node-red-context-redis (>=1.0.0-rc1, <=1.0.1) +161 more potentially affected by CVE-2026-12208 via jsonata (>=2.0.0, <=2.1.0)
jsonata NPM version =2.0.0, =0.1.6, =1.0.0-rc1, =5.0.0, =0.0.1, =2.3.132, =37.301.2, =1.0.4, =11.8.0, =0.3.0, =0.1.0, =1.0.0, =2.7.1-7dd573e-202408290941.0, =2.32.1-fc1b7da-202607021428.0 and more Source cves: CVE-2026-12208 Source advisory: SNYK:JS-JSONATA-17339139...
EUVD-2026-36680
A vulnerability was identified in Grit42 Grit up to 0.11.0. This issue affects the function Grit::Assays::DataTableEntity of the file modules/assays/backend/app/models/grit/assays/datatableentity.rb. The manipulation leads to sql injection. The attack is possible to be carried out remotely. The...
PT-2026-49234
Improper Access Control, Missing Authorization vulnerability in MIA Technology Inc. Pizzy Library allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pizzy Library: from 1.0.0.26250 before 1.3.9.26250...
CVE-2026-11526 GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in _make_filehandle
GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open of filename arguments in makefilehandle. GD::Image::makefilehandle opens a filename argument with Perl's 2-arg open, so a filename that begins or ends with a pipe "| cmd", "cmd |" or begins with a...
BIT-GITLAB-2026-3553 Incorrect Authorization in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.0 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user to access confidential issue details due to incorrect authorization checks...
BIT-GITLAB-2026-10087 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute arbitrary client-side code on behalf of a...
PT-2026-49078
Name of the Vulnerable Software and Affected Versions Grafana Operator versions prior to 5.24.0 Description A path traversal and privilege escalation issue exists when loading dashboards and library panels using the jsonnet data templating language. Because the jsonnet expression is evaluated...
@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +27 more potentially affected by CVE-2026-53831 via openclaw (>=2026.3.22, <=2026.5.7)
openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2.2.4, =2026.3.25, =4.0.0, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.14.42 and more Source cves: CVE-2026-53831 Source advisory: SNYK:JS-OPENCLAW-17339818...
@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.0-beta.7) +18 more potentially affected by CVE-2026-53825 via openclaw (>=2026.3.22, <=2026.4.5)
openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =4.2.0 - openclaw-chatclaw 0.1.0 and more Source cves: CVE-2026-53825 Source advisory: SNYK:JS-OPENCLAW-17394045...
@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +24 more potentially affected by CVE-2026-53835 via openclaw (>=2026.3.22, <=2026.5.2)
openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 and more Source cves: CVE-2026-53835 Source advisory: SNYK:JS-OPENCLAW-17394051...
CVE-2026-45775
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, a path traversal vulnerability in Discourse backup handling could allow an authenticated administrator on one site in a...
EUVD-2026-36596
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.0.14, cross-site GET request can trigger stored cron commands on a victim's agents. This issue has been patched in version 2.0.14...
CVE-2026-4870
CVE-2026-4870: IBM Qiskit SDK versions 0.43.0 through 2.5.0 are affected by a recursion-related issue in the parser that can trigger a segmentation fault and cause a denial of service. Public details in NVD/CVE records confirm the affected product range and the root cause as uncontrolled deep rec...
Security Bulletin: Qiskit SDK is vulnerable to specific functions may recurse too deeply and overflow the available stack space, when encountering certain classical expressions.
Summary The functions qiskit.qasm2.load and qiskit.qasm2.loads may recurse too deeply and overflow the available stack space, when encountering certain classical expressions. Vulnerability Details CVEID:CVE-2026-4870 DESCRIPTION: IBM Qiskit SDK could allow an attacker to trigger a segmentation...
CVE-2026-44785 Discourse: Hidden reply-to post raw can be disclosed through AI explain prompts
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, the AI "explain" helper only checks cansee? on the post being explained, not its replytopost, so any authenticated user wi...
@openinc/parse-server-opendash (>=4.0.0, <=4.0.29) potentially affected by CVE-2026-53726 via parse-server (>=9.6.0-alpha.37, <=9.8.0)
parse-server NPM version =9.6.0-alpha.37, =4.0.0, =4.0.29 Source cves: CVE-2026-53726 Source advisory: SNYK:JS-PARSESERVER-17339137...