23660 matches found
CVE-2026-47751 Claude Code Action: Malicious MCP Server Configuration in PRs Enables Remote Code Execution and Secret Exfiltration
Claude Code Action is a general-purpose GitHub action that runs Claude Code on GitHub pull requests and issues. Prior to 1.0.74, because the action checked out attacker-controlled pull request head branches, read .mcp.json from the working directory via default setting sources, and unconditionall...
July 14, 2026—KB5101649 (OS Build 28000.2525)
None None...
July 14, 2026—KB5099539 (OS Builds 19045.7548 and 19044.7548)
None None...
KLA91159 PE vulnerability in Microsoft Products (ESU)
Privilege escalation vulnerability was found in Microsoft Products ESU. Malicious users can exploit this vulnerability to gain privileges. Original advisories CVE-2026-58598 Exploitation CVE list CVE-2026-58598 high KB list 5099539 Solution Install necessary updates from the KB section, that are...
ALSA-2026:40895 Important: jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update
The general-purpose data-binding functionality and tree-model for Jackson Data Processor. It builds on core streaming parser/generator package, and uses Jackson Annotations for configuration. Security Fixes: jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution...
CVE-2026-55410
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.1.19, NocoBase @nocobase/plugin-backups restored PostgreSQL backups by interpolating the database.schema value from metadata.json into shell command strings executed with...
CVE-2026-52888
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. In 2.0.59 and earlier, NocoBase @nocobase/plugin-collection-sql used the checkSQL function in packages/plugins/@nocobase/plugin-collection-sql/src/server/utils.ts with an incomplete...
CVE-2026-45419
DataEase contains an arbitrary file write vulnerability present before version 2.10.23. The flaw resides in template handling: the TemplateManageService#save, StaticResourceServer#saveFilesToServe methods and the /de2api/templateManage/save endpoint accept attacker-controlled staticResource names...
CVE-2026-61451
The Grav API plugin grav-plugin-api before 1.0.4 does not validate the origin of the client-supplied adminbaseurl field in the POST /api/v1/auth/forgot-password endpoint. The sanitizeHttpUrl function only checks that the URL scheme is http/https and never verifies the host against the server's ow...
CVE-2026-61451
The Grav API plugin grav-plugin-api before 1.0.4 does not validate the origin of the client-supplied adminbaseurl field in the POST /api/v1/auth/forgot-password endpoint. The sanitizeHttpUrl function only checks that the URL scheme is http/https and never verifies the host against the server's ow...
CVE-2026-61451 Grav before 1.0.4 Password Reset Token Poisoning via admin_base_url
The Grav API plugin grav-plugin-api before 1.0.4 does not validate the origin of the client-supplied adminbaseurl field in the POST /api/v1/auth/forgot-password endpoint. The sanitizeHttpUrl function only checks that the URL scheme is http/https and never verifies the host against the server's ow...
CVE-2026-61451 Grav before 1.0.4 Password Reset Token Poisoning via admin_base_url
The Grav API plugin grav-plugin-api before 1.0.4 does not validate the origin of the client-supplied adminbaseurl field in the POST /api/v1/auth/forgot-password endpoint. The sanitizeHttpUrl function only checks that the URL scheme is http/https and never verifies the host against the server's ow...
EUVD-2026-44648
The Grav API plugin grav-plugin-api before 1.0.4 does not validate the origin of the client-supplied adminbaseurl field in the POST /api/v1/auth/forgot-password endpoint. The sanitizeHttpUrl function only checks that the URL scheme is http/https and never verifies the host against the server's ow...
CVE-2026-61451 Grav before 1.0.4 Password Reset Token Poisoning via admin_base_url
The Grav API plugin grav-plugin-api before 1.0.4 does not validate the origin of the client-supplied adminbaseurl field in the POST /api/v1/auth/forgot-password endpoint. The sanitizeHttpUrl function only checks that the URL scheme is http/https and never verifies the host against the server's ow...
Malicious code in creditgauge (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0bd064afe94f426f1124703c1c1f7ac52ee1ad1df728c33ce7cbe4328bae876 The package has no functional library code: package.json declares main=index.js but no index.js is shipped; the tarball contains only package.json an...
The vulnerability of the elng_box_read() function in the src/isomedia/box_code_base.c file, belonging to the MP4Box encoder of the GPAC multimedia platform, allows a hacker to disclose protected information or cause service failures.
The vulnerability of the elngboxread function in the src/isomedia/boxcodebase.c file, belonging to the MP4Box encoder of the GPAC multimedia platform, is related to the execution of operations outside of the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to...
PT-2026-60145
Name of the Vulnerable Software and Affected Versions grav-plugin-api versions prior to 1.0.4 Description An unauthenticated attacker can cause a password reset email to contain a link pointing to a server under their control. This occurs because the sanitizeHttpUrl function fails to verify the...
Oracle Linux 7 : 389-ds-base (ELSA-2026-26453)
The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-26453 advisory. - Security fix for CVE-2026-9064 Orabug: 39570202 - Security fix for CVE-2025-14905 Orabug: 39146844 Tenable has extracted the preceding description block...
Oracle Linux 10 : gstreamer1-plugins-bad-free, / gstreamer1-plugins-base, / gstreamer1-plugins-good, / and / gstreamer1-plugins-ugly-free (ELSA-2026-19024)
The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-19024 advisory. - Add patches for CVE-2026-2923 and CVE-2026-3082 Resolves: RHEL-156114, RHEL-156172 - Add patch for CVE-2026-2921 Resolves: RHEL-156122...
