169459 matches found
SUSE CVE-2026-83601
Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized DIMENSION SLOT value that str2ullencoded passes to pluginsdrrddimputtoslot in src/plugins.d/pluginsdinternals.h without an upper bound. prdarraycreate in...
Security Bulletin: This Power System update is being released to address CVE-2026-17511
Summary Power Systems Firmware is affected by a vulnerability in the partition resource dump interface. An attacker with authenticated administrator-level access to the HMC or service processor can obtain a limited snapshot of partition processor state. Successful exploitation results in a...
postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator
A flaw was found in PostgreSQL. This vulnerability, stemming from a type confusion issue in the ctid data type selectivity estimator, could allow an authenticated object creator to access and potentially recover sensitive information from memory. By manipulating input, an attacker could gain...
DRUPAL-CONTRIB-2026-165
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. When Webform is used with JSON:API enabled, submissions may be cached without varying correctly by the authenticated user. If a webform is configured so that...
CVE-2026-79306
CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply absolute or otherwise out-of-scope file paths in the listOfFiles JSON property...
CVE-2026-79304
CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply an arbitrary absolute or out-of-scope path in the fileName JSON property. Because...
CVE-2026-18180
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to SQL injection...
CVE-2026-96655
Plex Media Server versions before 1.43.3.10861 are vulnerable to a Server-Side Request Forgery (SSRF) . An authenticated user can exploit the '/video/:/transcode/universal' path parameter to force the server to make requests to arbitrary internal or external addresses . The provided documents do ...
CVE-2026-96655 Plex Media Server arbitrary-host SSRF
Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter...
CVE-2026-96655 Plex Media Server arbitrary-host SSRF
Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter...
EUVD-2026-85369
Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter...
CVE-2026-18180 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to SQL injection...
CVE-2026-18180 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to SQL injection...
EUVD-2026-85348
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to SQL injection...
CVE-2026-18180
IBM Financial Transaction Manager (FTM) for RedHat OpenShift is impacted by a vulnerability that could allow a remote authenticated attacker to obtain sensitive information . This security flaw is caused by an SQL injection vulnerability. No specific affected versions, remediation steps, or explo...
CVE-2026-88974
WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-level editposts capability and the post author, but does not enforce the object-level editpost capability or require publishposts for publ...
CVE-2026-62998
REDAXO is a PHP-based content management system. Prior to 5.21.2, rexlist::getSortColumn in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable registered the requested column. An authenticated backend user can make prepareQuery add an escape...
USN-8805-1 moodle vulnerability
It was discovered that Moodle did not properly restrict URLs. An authenticated user could possibly use this issue to perform a server-side request forgery attack and expose sensitive information...
CVE-2026-88974 WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost
WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-level editposts capability and the post author, but does not enforce the object-level editpost capability or require publishposts for publ...
CVE-2026-88974
The WPGraphQL plugin (prior to version 2.22.2 ) contains an authorization bypass in the updatePost mutation within src/Mutation/PostObjectUpdate.php. The root cause is that the mutation only validates the collection-level edit_posts capability and post authorship, failing to enforce object-level ...