1897328 matches found
CVE-2026-72133
A flaw was found in the Linux kernel's spi: uniphier driver. The driver attempts to use an internal synchronization mechanism before it has been properly set up. If an interrupt occurs at a precise moment, the system may try to operate on this uninitialized mechanism, leading to unpredictable...
qwen3.8-9b-cyber-exploit-agent-uncensored
Qwen3.8-9B Cyber Exploit Agent — UNCENSORED Identical fine-tu...
Exploit for Classic Buffer Overflow in Cisco Secure_Endpoint
ZendTo 6.15-8 / ClamAV exact-profile RCE and root-variant repr...
MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id
Summary The validatesourcerun and validatesourcemodel functions in mlflow/server/handlers.py verify that a model version source path is within the artifact directory of a specified run or logged model, but do not check whether the caller has READ permission on that run or model. An authenticated...
GHSA-GQCH-G4W5-7QCW MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id
Summary The validatesourcerun and validatesourcemodel functions in mlflow/server/handlers.py verify that a model version source path is within the artifact directory of a specified run or logged model, but do not check whether the caller has READ permission on that run or model. An authenticated...
GHSA-7GWP-5PFP-969J MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
Summary The default MLflow Tracking Server mlflow server, no authentication, default SQLite backend exposes the model-registry webhooks API unauthenticated, including a synchronous POST /api/2.0/mlflow/webhooks/id/test endpoint that returns the upstream response status and body to the caller. The...
MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
Summary The default MLflow Tracking Server mlflow server, no authentication, default SQLite backend exposes the model-registry webhooks API unauthenticated, including a synchronous POST /api/2.0/mlflow/webhooks/id/test endpoint that returns the upstream response status and body to the caller. The...
9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint
Summary A Server-Side Request Forgery SSRF vulnerability exists in the 9Router dashboard via the /api/auth/oidc/test endpoint. The application accepts a user-controlled URL string through the issuerUrl parameter and performs an outbound HTTP request without validating if the destination IP belong...
GHSA-8G4W-4FFG-8VGX 9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint
Summary A Server-Side Request Forgery SSRF vulnerability exists in the 9Router dashboard via the /api/auth/oidc/test endpoint. The application accepts a user-controlled URL string through the issuerUrl parameter and performs an outbound HTTP request without validating if the destination IP belong...
chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots
Summary I originally reported this through Google Bug Hunters. The Google Bug Hunters team said this is in OSS VRP scope but not reward-eligible due to the project tier, and asked me to file an issue or PR directly with this repository. I am reporting it privately here first because it is an...
GHSA-8QF9-62X2-82PP chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots
Summary I originally reported this through Google Bug Hunters. The Google Bug Hunters team said this is in OSS VRP scope but not reward-eligible due to the project tier, and asked me to file an issue or PR directly with this repository. I am reporting it privately here first because it is an...
http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS
Impact ServerFilters.GZip and RequestFilters.GunZip and the underlying Gzip functions used to decompress request bodies did not impose any cap on the decompressed size. A small malicious gzip-encoded request body on the order of kilobytes could decompress to gigabytes, exhausting the JVM heap and...
GHSA-G4W2-6H2R-3M3W http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS
Impact ServerFilters.GZip and RequestFilters.GunZip and the underlying Gzip functions used to decompress request bodies did not impose any cap on the decompressed size. A small malicious gzip-encoded request body on the order of kilobytes could decompress to gigabytes, exhausting the JVM heap and...
Security Bulletin: IBM i is Affected By A Buffer Overflow Vulnerability [CVE-2026-18102]
Summary IBM i is vulnerable to heap-based buffer overflow CVE-2026-18102 as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-18102 DESCRIPTION: IBM i could allow a remote authenticated attacker to overwrite adjacent memory due to an integer underflow during...
Security Bulletin: IBM i is Affected By Denial of Service in Host Servers [CVE-2026-17015]
Summary IBM i is vulnerable to a denial of service due to an out-of-bounds read CVE-2026-17015 as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-17015 DESCRIPTION: IBM i could allow a remote authenticated attacker to cause a denial of service and obtain...
CVE-2026-65832
Deskflow is a keyboard and mouse sharing app. Prior to continuous build 1.26.0.299, a remote unauthenticated Deskflow server can send kMsgDSetOptions DSOP values to ServerProxy::setOptions in src/lib/client/ServerProxy.cpp so that the value following a modifier option poisons...
CVE-2026-14456
A flaw was found in OpenSSL. A remote attacker could exploit this by sending a large number of QUIC Initial packets to an OpenSSL QUIC server. This can cause the server to allocate and queue new incoming channels without limit, leading to unbounded memory growth. The excessive memory consumption...
Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects
GitLab has released security updates to address a critical vulnerability impacting its Community Edition CE and Enterprise Edition EE software that, under certain conditions, could allow an unauthenticated attacker to remotely modify or delete public projects and user data. The flaw, tracked as...
CVE-2026-65832
Deskflow is a keyboard and mouse sharing app. Prior to continuous build 1.26.0.299, a remote unauthenticated Deskflow server can send kMsgDSetOptions DSOP values to ServerProxy::setOptions in src/lib/client/ServerProxy.cpp so that the value following a modifier option poisons...
EUVD-2026-60464
Deskflow is a keyboard and mouse sharing app. Prior to continuous build 1.26.0.299, a remote unauthenticated Deskflow server can send kMsgDSetOptions DSOP values to ServerProxy::setOptions in src/lib/client/ServerProxy.cpp so that the value following a modifier option poisons...