90433 matches found
CVE-2026-102277 vulnerabilities
Vulnerabilities for packages: pelias-api, gitlab-rails-ce-fips, rancher-api-ui, lerna, arangodb, commercial-gitlab-rails-ee, lambda-nodejs, unleash-fips, renovate, wazuh-dashboard-fips, sqlpad, langfuse, verdaccio, langfuse-fips, commercial-gitlab-rails-ee-fips, wazuh-dashboard,...
CVE-2026-102278 vulnerabilities
Vulnerabilities for packages: pelias-api, gitlab-rails-ce-fips, rancher-api-ui, lerna, arangodb, commercial-gitlab-rails-ee, lambda-nodejs, unleash-fips, renovate, wazuh-dashboard-fips, sqlpad, langfuse, verdaccio, langfuse-fips, commercial-gitlab-rails-ee-fips, wazuh-dashboard,...
GHSA-Q2HR-2G5M-VWHR vulnerabilities
Vulnerabilities for packages: pelias-api, gitlab-rails-ce-fips, rancher-api-ui, lerna, arangodb, commercial-gitlab-rails-ee, lambda-nodejs, unleash-fips, renovate, wazuh-dashboard-fips, sqlpad, langfuse, verdaccio, langfuse-fips, commercial-gitlab-rails-ee-fips, wazuh-dashboard,...
GHSA-QHR7-859C-M2P7 vulnerabilities
Vulnerabilities for packages: pelias-api, gitlab-rails-ce-fips, rancher-api-ui, lerna, arangodb, commercial-gitlab-rails-ee, lambda-nodejs, unleash-fips, renovate, wazuh-dashboard-fips, sqlpad, langfuse, verdaccio, langfuse-fips, commercial-gitlab-rails-ee-fips, wazuh-dashboard,...
CVE-2026-103533 David-Crty databasement database-servers API Endpoint RestoreRequest.php 511 path traversal
A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty/databasement/pull/511 of the file app/Http/Requests/Api/V1/RestoreRequest.php of the component database-servers API Endpoint. The manipulation of the argument schemaname result...
CVE-2026-103533
A path traversal vulnerability exists in the database-servers API Endpoint of David-Crty databasement versions up to 1.7.1 . The flaw is located in the app/Http/Requests/Api/V1/RestoreRequest.php file and stems from the improper handling of the schema_name argument. An attacker can potentially la...
CVE-2026-103533 David-Crty databasement database-servers API Endpoint RestoreRequest.php 511 path traversal
A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty/databasement/pull/511 of the file app/Http/Requests/Api/V1/RestoreRequest.php of the component database-servers API Endpoint. The manipulation of the argument schemaname result...
CVE-2026-103533 David-Crty databasement database-servers API Endpoint RestoreRequest.php 511 path traversal
A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty/databasement/pull/511 of the file app/Http/Requests/Api/V1/RestoreRequest.php of the component database-servers API Endpoint. The manipulation of the argument schemaname result...
SUSE CVE-2026-13719
An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0,...
SUSE CVE-2026-13720
An Editor can set file-provisioning metadata the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, a...
SUSE CVE-2026-81842
An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library elements API or the equivalent App Platform resource. The update path did not check library panel create permission on the destination...
CLEANSTART-2026-KK56976 Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON
CVE-2026-49844 affects multiple packages. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. See references for individual vulnerability details...
EUVD-2026-90429
AJA HELO Plus firmware before 2.1.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers with network access to inject malicious JavaScript by setting an unsanitized eParamIDSystemName value through the /config?action=set web configuration API. Attackers can...
CVE-2026-103272: Observable Discrepancy
Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauthenticated attackers to leak user data. Attackers can observe discrepancies in API metadata responses to enumerate staff members and extract sensitive information without...
PT-2026-105837
Summary The OAuth token fallback file storage in OAuthConfig. save tokens to file creates token files containing access tokens, refresh tokens, and cloud IDs with default filesystem permissions typically 0644 on Linux, world-readable. Any local user on a shared system can read these files to obta...
CVE-2026-51895
Ragflow 0.24.0 and prior contains improper access control in updatemetadatasetting api/apps/kbapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...
PT-2026-105169
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqp uri:remove credentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GE...
PT-2026-105518
Summary /api/system/getConf serves Conf.UILayout to publish readers after passing it through FilterConfByPublishIgnore, whose only function is to filter that layout. The layout is written exclusively by setUILayout, which is administrator-gated, so what readers receive is the administrator's own...
PT-2026-103803
Name of the Vulnerable Software and Affected Versions Ghost versions 4.0.0 through 6.62.0 Description A flaw in the content API allows unauthenticated visitors to access gated post content. Attackers can bypass content restrictions by directly querying the content API to retrieve restricted posts...