3105 matches found
PT-2026-82621
Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.4 Description Path traversal occurs in model-artifact APIs when pathsec is enabled. The issue arises from the use of raw file operations on caller-controlled paths, which allows bypassing pathsec enforcement. This...
CVE-2026-75419
go-wind-cms (GoWind) before 1.0.0 suffers from a missing authorization flaw. The NewAuthorizer() function in app/admin/service/internal/data/data.go and app/app/service/internal/data/data.go returns a no-op authorization engine (noop.State{}), causing the authz middleware to always allow requests...
CVE-2026-75419
go-wind-cms GoWind before 1.0.0 has a missing authorization vulnerability. The NewAuthorizer function in app/admin/service/internal/data/data.go and app/app/service/internal/data/data.go returns a no-op authorization engine noop.State, so the authz middleware always allows requests. Any...
CVE-2026-75338
disconf Distributed Configuration Management Platform 2.6.36 is vulnerable to Incorrect Access Control. The config-fetching APIs /api/config/item, /api/config/file, /api/config/list and /api/config/simple/list are exposed without authentication. The LoginInterceptor explicitly whitelists these fo...
CVE-2026-75338
disconf Distributed Configuration Management Platform 2.6.36 is vulnerable to Incorrect Access Control. The config-fetching APIs /api/config/item, /api/config/file, /api/config/list and /api/config/simple/list are exposed without authentication. The LoginInterceptor explicitly whitelists these fo...
CVE-2026-75338
The disconf (Distributed Configuration Management Platform) version 2.6.36 is vulnerable to Incorrect Access Control . The root cause is that the LoginInterceptor explicitly whitelists four specific config-fetching API endpoints, making them accessible without authentication. An anonymous attacke...
CVE-2026-57897
A flaw was found in Gitea. This vulnerability allows for cross-repository information disclosure through the use of Org-Level Actions Run/Job Application Programming Interfaces APIs. An attacker could exploit this to gain unauthorized access to sensitive information across different repositories...
Astra Linux – Vulnerability in Chromium
In Networking APIs of Google Chrome, before version 112.0.5615.49, it was possible for a remote attacker to exploit heap corruption by using a crafted HTML page, as long as that attacker could convince a user to perform certain UI interactions. Chromium security severity: Medium...
Astra Linux – Vulnerability in Firefox and Thunderbird
Sandbox escape due to a use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9...
Security Bulletin: IBM Spectrum Control is vulnerable to weaknesses related to immutable-4.3.5.tgz (CVE-2026-29063)
Summary Immutable is vulnerable to a Prototype Pollution attack. This vulnerability affects IBM Spectrum Control. Vulnerability Details CVEID:CVE-2026-29063 DESCRIPTION: Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution...
CVE-2026-50222
Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs. Several userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachin...
CVE-2026-50222
Apache CloudStack versions 4.18.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 are vulnerable to a missing authorization flaw in several userdata-related APIs. Specifically, the deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachine, and updateVirtualMach...
CVE-2026-50222 Apache CloudStack: Improper access control in Userdata reference APIs
Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs. Several userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachin...
EUVD-2026-63846
Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs. Several userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachin...
CVE-2026-50222 Apache CloudStack: Improper access control in Userdata reference APIs
Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs. Several userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachin...
PT-2026-79317
Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.18.0.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0 Description Insufficient access control validation in several userdata-related APIs may allow unauthorized cross-tenant or cross-account...
Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: firefox (UTSA-2026-101349)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101349 advisory. Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11,...
CVE-2026-57897
Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs...
CVE-2026-57897 Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs
Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs...
firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the Disability Access APIs component...