139 matches found
CVE-2026-114114
A flaw was found in Vyper. The compiler improperly calculates source code positions by mixing character-based offsets with byte offsets during parsing. An attacker contributing source code can exploit this flaw by introducing multi-byte characters or invisible markers to shift internal code...
PT-2026-79973
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.10, 7.8.10, 8.24.1, and 9.7.2, passing a user-controlled update such as MyModel.updateOnefilter, req.body can exploit Mongoose update casting with a proto .x dotted path under $set...
CVE-2026-73562
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.10, 7.8.10, 8.24.1, and 9.7.2, passing a user-controlled update such as MyModel.updateOnefilter, req.body can exploit Mongoose update casting with a proto.x dotted path under $set...
CVE-2026-73562: Improperly Controlled Modification of Object Prototype Attributes
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.10, 7.8.10, 8.24.1, and 9.7.2, passing a user-controlled update such as MyModel.updateOnefilter, req.body can exploit Mongoose update casting with a proto.x dotted path under $set...
EUVD-2026-23126
A flaw was found in ArgoCD Image Updater. This vulnerability allows an attacker, with permissions to create or modify an ImageUpdater resource in a multi-tenant environment, to bypass namespace boundaries. By exploiting insufficient validation, the attacker can trigger unauthorized image updates ...
CVE-2026-6388 Argocd-image-updater: argocd image updater: cross-namespace privilege escalation via insufficient namespace validation
A flaw was found in ArgoCD Image Updater. This vulnerability allows an attacker, with permissions to create or modify an ImageUpdater resource in a multi-tenant environment, to bypass namespace boundaries. By exploiting insufficient validation, the attacker can trigger unauthorized image updates ...
CVE-2026-24744: Improper Neutralization of Input During Web Page Generation
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting XSS vulnerability occurs in the Edit Invoices functions of InvoicePlane version 1.7.0. When editing invoices, the application does not validate user input at the...
CVE-2018-14705
In Drobo 5N2 4.0.5, all optional applications lack any form of authentication/authorization validation. As a result, any user capable of accessing the device over the network may interact with and control these applications. This not only poses a severe risk to the availability of these...
CVE-2022-35291
Due to misconfigured application endpoints, SAP SuccessFactors attachment APIs allow attackers with user privileges to perform activities with admin privileges over the network. These APIs were consumed in the SF Mobile application for Time Off, Time Sheet, EC Workflow, and Benefits. On successfu...
SAP S/4HANA security vulnerabilities
SAP S/4HANA is an enterprise resource management software based on the SAP HANA in-memory database system from SAP, Germany. A security vulnerability exists in SAP S/4HANA that stems from a lack of authorization checking, which could lead to an attacker removing a sharing rule condition by...
EUVD-2021-13242
Malware in sbrugna...
EUVD-2020-20327
Malware in sbrugna...
EUVD-2019-10423
Malware in sbrugna...
EUVD-2021-14361
Malware in sbrugna...
EUVD-2020-7764
Malware in sbrugna...
EUVD-2021-8745
Malicious code in bioql PyPI...
EUVD-2023-46918
Malicious code in bioql PyPI...
EUVD-2022-52224
Malicious code in bioql PyPI...