1041 matches found
CVE-2026-15829
A SQL injection CWE-89 and security boundary bypass CWE-863 vulnerability exists in the prebuilt BigQuery forecasting tool bigquery-forecast of googleapis/mcp-toolbox. The tool accepts client-controlled parameters datacol, timestampcol, and idcols as plain strings and interpolates them unescaped...
GHSA-6X6H-QQR7-855W LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests
Summary The server defaults to CORSORIGINS= combined with allowcredentials=True. Starlette's CORSMiddleware echoes the requesting origin in preflight responses when credentials are enabled, meaning every origin is effectively whitelisted for credentialed cross-origin requests. Any malicious websi...
CVE-2026-53367
In the Linux kernel, the following vulnerability has been resolved: selinux: fix avdcache auditing The per-task avdcache was incorrectly saving and reusing the audited vector computed by avcauditrequired rather than recomputing based on the currently requested permissions and distinguishing the...
CVE-2026-53367
In the Linux kernel, the following vulnerability has been resolved: selinux: fix avdcache auditing The per-task avdcache was incorrectly saving and reusing the audited vector computed by avcauditrequired rather than recomputing based on the currently requested permissions and distinguishing the...
EUVD-2026-45437
In the Linux kernel, the following vulnerability has been resolved: selinux: fix avdcache auditing The per-task avdcache was incorrectly saving and reusing the audited vector computed by avcauditrequired rather than recomputing based on the currently requested permissions and distinguishing the...
CVE-2026-53367
CVE-2026-53367 concerns the Linux kernel where SELinux’s avdcache auditing was incorrect. The per-task avdcache saved and reused the audited vector produced by avc_audit_required() instead of recomputing it for the currently requested permissions, and it failed to distinguish between denied and a...
CVE-2026-53367 selinux: fix avdcache auditing
In the Linux kernel, the following vulnerability has been resolved: selinux: fix avdcache auditing The per-task avdcache was incorrectly saving and reusing the audited vector computed by avcauditrequired rather than recomputing based on the currently requested permissions and distinguishing the...
EUVD-2026-45409
A vulnerability was detected in Sipeed PicoClaw up to 0.2.9. The impacted element is an unknown function of the file web/backend/middleware/accesscontrol.go of the component First Run Setup. Performing a manipulation of the argument allowedcidrs results in authentication bypass using alternate...
CVE-2026-16198
A vulnerability was detected in Sipeed PicoClaw up to 0.2.9. The impacted element is an unknown function of the file web/backend/middleware/accesscontrol.go of the component First Run Setup. Performing a manipulation of the argument allowedcidrs results in authentication bypass using alternate...
PT-2026-61069
In the Linux kernel, the following vulnerability has been resolved: selinux: fix avdcache auditing The per-task avdcache was incorrectly saving and reusing the audited vector computed by avc audit required rather than recomputing based on the currently requested permissions and distinguishing the...
CVE-2026-16198
The CVE affects Sipeed PicoClaw ≤ 0.2.9, specifically the First Run Setup’s web/backend/middleware/access_control.go where manipulation of the allowed_cidrs argument enables authentication bypass via an alternate channel. The issue can be triggered remotely and has high attack complexity with no ...
CVE-2026-16198 Sipeed PicoClaw First Run Setup access_control.go authentication bypass
A vulnerability was detected in Sipeed PicoClaw up to 0.2.9. The impacted element is an unknown function of the file web/backend/middleware/accesscontrol.go of the component First Run Setup. Performing a manipulation of the argument allowedcidrs results in authentication bypass using alternate...
CVE-2026-45162
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 LTS and 12.3.7, multiple Pimcore locations call PHP's unserialize on data from database columns and filesystem files without the allowedclasses restriction, including lib/Tool/Authentication.php, models/Site/Dao.php...
EUVD-2026-45259
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 LTS and 12.3.7, multiple Pimcore locations call PHP's unserialize on data from database columns and filesystem files without the allowedclasses restriction, including lib/Tool/Authentication.php, models/Site/Dao.php...
CVE-2026-45162
Pimcore is affected by unsafe PHP deserialization across multiple locations. Prior to versions 11.5.17 (LTS) and 12.3.7, several Pimcore code paths call unserialize() on data from database columns and filesystem files without restricting allowed_classes, enabling object injection and potential re...
CVE-2026-45162 Pimcore: Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 LTS and 12.3.7, multiple Pimcore locations call PHP's unserialize on data from database columns and filesystem files without the allowedclasses restriction, including lib/Tool/Authentication.php, models/Site/Dao.php...
EUVD-2026-45134
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 4.16.18 via the allowedmimetypes function. This is due to the unconditional...
EUVD-2026-45107
OpenClaw 2026.2.12 before 2026.5.26 contain an authorization bypass vulnerability in the hooks allowedAgentIds validation. A lower-trust caller or configured input path can bypass agent ID restrictions by submitting blank agent IDs, allowing actions that should require stronger authorization or...
CVE-2026-62219 OpenClaw 2026.2.12 < 2026.5.26 Authorization Bypass via Blank Agent IDs
OpenClaw 2026.2.12 before 2026.5.26 contain an authorization bypass vulnerability in the hooks allowedAgentIds validation. A lower-trust caller or configured input path can bypass agent ID restrictions by submitting blank agent IDs, allowing actions that should require stronger authorization or...
CVE-2026-62219 OpenClaw 2026.2.12 < 2026.5.26 Authorization Bypass via Blank Agent IDs
OpenClaw 2026.2.12 before 2026.5.26 contain an authorization bypass vulnerability in the hooks allowedAgentIds validation. A lower-trust caller or configured input path can bypass agent ID restrictions by submitting blank agent IDs, allowing actions that should require stronger authorization or...