3167 matches found
CVE-2026-73305
CVE-2026-73305 affects Budibase prior to 3.39.24. The public role-assign API /api/public/v1/roles/assign validates only global flags (admin/builder) and neglects per-app authorization (appBuilder.appId, role.appId). An app-scoped builder could scope actions to an app they control and grant themse...
CVE-2026-73305 Budibase: Privilege escalation via public role assignment API missing app-level authorization
Budibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign called validateGlobalRoleUpdate without checking appBuilder.appId or role.appId in packages/server/src/api/controllers/public/globalRoleValidation.ts. An app-scoped builder could scope the request to ...
Memory Allocation with Excessive Size Value
Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the size parameter. An attacker can cause memory exhaustion and terminate the node...
CVE-2026-73656 Trigger.dev: Cross-project deployment worker registration can modify another project's deployment state
Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.6, POST /api/v1/deployments/:deploymentId/background-workers calls CreateDeploymentBackgroundWorkerServiceV4.call in apps/webapp/app/v3/services/createDeploymentBackgroundWorkerV4.server.ts,...
CVE-2026-73654 Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS
Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 3.3.8 until 4.5.6, the PUT /api/v1/runs/:runId/metadata endpoint passes attacker-controlled operation.key values to new JSONHeroPathoperation.key.setnewMetadata, value in...
CVE-2026-72678 Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service
Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal data structure. An authenticated user holding only read privileges can submit a single small crafted request to a product API endpoint that causes the node to...
CVE-2026-72678
CVE-2026-72678 : Elasticsearch vulnerability where a user-controlled size value is not validated before memory reservation, enabling memory exhaustion. An authenticated user with read privileges can send a single crafted request to a REST API endpoint, causing the node to attempt an excessively l...
EUVD-2026-58252
Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal data structure. An authenticated user holding only read privileges can submit a single small crafted request to a product API endpoint that causes the node to...
GHSA-87X5-VMC3-756J vLLM: Completion prompt lists fan out into unbounded engine requests
Summary The /v1/completions request model accepts prompt as a list of text prompts or a list of token-id prompts without any outer prompt-count bound. The serving path turns each element into a separate engine input, creates one engine generator per element, merges all generators, and allocates a...
CVE-2026-58427
Private org member list leaked via /members API endpoint — incomplete fix for PR 38145...
CVE-2026-24791
The Gitea Git repository management system is affected by an incorrect authorization vulnerability (CVE-2026-24791 ). The root cause is that public-only tokens can be used to bypass private-resource restrictions on /api/v1/user self routes. Successful exploitation allows an attacker to increase t...
CVE-2026-24791 Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes
Public-only tokens bypass private-resource restrictions on /api/v1/user self routes...
EUVD-2026-58127
Public-only tokens bypass private-resource restrictions on /api/v1/user self routes...
CVE-2026-24791 Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes
Public-only tokens bypass private-resource restrictions on /api/v1/user self routes...
CVE-2026-58510 GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private
GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public-private...
CVE-2026-58433 Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting
Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting...
CVE-2026-58427
Private org member list leaked via /members API endpoint — incomplete fix for PR 38145...
CVE-2026-58427 Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
Private org member list leaked via /members API endpoint — incomplete fix for PR 38145...