CVE-2026-113495 Cockpit-machines: cockpit-appstream: rhsm access-token disclosure through image helper command-line arguments

A flaw was found in cockpit-machines. Red Hat Subscription Management RHSM authentication tokens are passed as command-line arguments to background helper processes during image retrieval operations. A local, unprivileged attacker on a system permitting cross-user process inspection can view thes...

CVE-2026-113495

A flaw in cockpit-machines allows for the disclosure of Red Hat Subscription Management (RHSM) authentication tokens. During image retrieval operations, these tokens are passed as command-line arguments to background helper processes. A local, unprivileged attacker capable of cross-user process i...

CVE-2026-113495 Cockpit-machines: cockpit-appstream: rhsm access-token disclosure through image helper command-line arguments

A flaw was found in cockpit-machines. Red Hat Subscription Management RHSM authentication tokens are passed as command-line arguments to background helper processes during image retrieval operations. A local, unprivileged attacker on a system permitting cross-user process inspection can view thes...

CVE-2026-113496

A flaw was found in cockpit-machines. When saving Virtual Network Computing VNC console settings, the configured password is passed directly as a command-line argument to an underlying system utility. A local unprivileged attacker on a host that allows cross-user process inspection could read the...

CVE-2026-113495

A flaw was found in cockpit-machines. Red Hat Subscription Management RHSM authentication tokens are passed as command-line arguments to background helper processes during image retrieval operations. A local, unprivileged attacker on a system permitting cross-user process inspection can view thes...

CVE-2026-9589 Unblu Spark Authorization Bypass in Configuration Cascade Operations

Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren't...

CVE-2026-9589 Unblu Spark Authorization Bypass in Configuration Cascade Operations

Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren't...

CVE-2026-9589

The Collaboration Server in Unblu Spark (versions 7.0 through 8.36.1-hotfix.0) is vulnerable to a missing authorization flaw during configuration cascade operations. The system fails to verify if a user has the necessary permissions to read or modify the configuration of a specific entity. This a...

CVE-2026-113378

A security flaw has been discovered in mcollina mcp-ripgrep up to 0.4.0. Affected is an unknown function of the file src/index.ts of the component Advanced Search Tool. The manipulation of the argument fileType results in os command injection. The attack requires a local approach. The exploit has...

CVE-2026-113381

A weakness has been identified in Osclass up to 8.3.1. Affected by this vulnerability is the function Item::findUserItems of the file oc-includes/osclass/model/Item.php of the component Item Model Handler. This manipulation of the argument sPattern causes sql injection. The attack may be initiate...

CVE-2026-113382 arizu-id fast-tunnel Plugin Installer api_plugins.php extractTo unrestricted upload

A security vulnerability has been detected in arizu-id fast-tunnel 1.0.0. Affected by this issue is the function ZipArchive::extractTo of the file backend/apiplugins.php of the component Plugin Installer. Such manipulation of the argument pluginfile leads to unrestricted upload. The attack may be...

CVE-2026-113382

The arizu-id fast-tunnel software (version 1.0.0 ) contains a vulnerability in the Plugin Installer component. Specifically, the backend/api_plugins.php file utilizes the ZipArchive::extractTo function in a way that allows an attacker to manipulate the plugin_file argument. This flaw leads to an ...

CVE-2026-113382 arizu-id fast-tunnel Plugin Installer api_plugins.php extractTo unrestricted upload

A security vulnerability has been detected in arizu-id fast-tunnel 1.0.0. Affected by this issue is the function ZipArchive::extractTo of the file backend/apiplugins.php of the component Plugin Installer. Such manipulation of the argument pluginfile leads to unrestricted upload. The attack may be...

CVE-2026-113381 Osclass Item Model Item.php findUserItems sql injection

A weakness has been identified in Osclass up to 8.3.1. Affected by this vulnerability is the function Item::findUserItems of the file oc-includes/osclass/model/Item.php of the component Item Model Handler. This manipulation of the argument sPattern causes sql injection. The attack may be initiate...

EUVD-2026-104877

A weakness has been identified in Osclass up to 8.3.1. Affected by this vulnerability is the function Item::findUserItems of the file oc-includes/osclass/model/Item.php of the component Item Model Handler. This manipulation of the argument sPattern causes sql injection. The attack may be initiate...

CVE-2026-113381

A SQL injection vulnerability exists in Osclass up to version 8.3.1 . The flaw is located within the Item Model Handler component, specifically in the Item::findUserItems function of the file oc-includes/osclass/model/Item.php. The root cause is the improper handling of the sPattern argument, whi...

CVE-2026-113381 Osclass Item Model Item.php findUserItems sql injection

A weakness has been identified in Osclass up to 8.3.1. Affected by this vulnerability is the function Item::findUserItems of the file oc-includes/osclass/model/Item.php of the component Item Model Handler. This manipulation of the argument sPattern causes sql injection. The attack may be initiate...

CVE-2026-113378 mcollina mcp-ripgrep Advanced Search Tool index.ts os command injection

A security flaw has been discovered in mcollina mcp-ripgrep up to 0.4.0. Affected is an unknown function of the file src/index.ts of the component Advanced Search Tool. The manipulation of the argument fileType results in os command injection. The attack requires a local approach. The exploit has...

CVE-2026-113378 mcollina mcp-ripgrep Advanced Search Tool index.ts os command injection

A security flaw has been discovered in mcollina mcp-ripgrep up to 0.4.0. Affected is an unknown function of the file src/index.ts of the component Advanced Search Tool. The manipulation of the argument fileType results in os command injection. The attack requires a local approach. The exploit has...

CVE-2026-113378

A security flaw in mcollina mcp-ripgrep (up to version 0.4.0 ) allows for OS command injection within the Advanced Search Tool component. The vulnerability exists in an unknown function of the src/index.ts file, where the manipulation of the fileType argument leads to command injection due to a C...