351617 matches found
CVE-2026-19594 Path Traversal and HTTP Parameter Pollution in Snowflake Python API (snowflake.core) Allow Confused-Deputy Privilege Escalation
Insufficient input sanitization in Snowflake Python API snowflake.core versions prior to 1.13.0 allowed confused-deputy privilege escalation through two related weaknesses: path traversal CWE-22 via unencoded .. identifier path segments, and HTTP parameter pollution CWE-141 via unencoded &//=...
CVE-2026-19594 Path Traversal and HTTP Parameter Pollution in Snowflake Python API (snowflake.core) Allow Confused-Deputy Privilege Escalation
Insufficient input sanitization in Snowflake Python API snowflake.core versions prior to 1.13.0 allowed confused-deputy privilege escalation through two related weaknesses: path traversal CWE-22 via unencoded .. identifier path segments, and HTTP parameter pollution CWE-141 via unencoded &//=...
CVE-2026-19594
The CVE concerns the Snowflake Python API (snowflake.core) prior to version 1.13.0. It describes two weaknesses arising from insufficient input sanitization: path traversal (CWE-22) via unencoded “..” path segments and HTTP parameter pollution (CWE-141) via unencoded characters in query string va...
bind: bind9: Potential memory usage beyond configured limits
A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the...
K000162875: Linux kernel vulnerability CVE-2026-53160
Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix use-after-free race in fastrpcmapcreate fastrpcmaplookup returns a raw pointer after releasing fl-lock. The caller fastrpcmapcreate then calls fastrpcmapget krefgetunlesszero on th...
OPENSUSE-SU-2026:21555-1 Security update for the Linux Kernel
The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2026-23259: iouring/rw: free potentially allocated iovec on cache put failure bsc1259866. - CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled...
PT-2026-71314
A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Driver can result in an out-of-bounds write in the client application process. Triggering this issue requires control over the server the driver connects to, or the ability to respond in its...
PT-2026-71210
Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform server-side request forgery and read local files via a crafted URL parameter to the threat intel source configuration endpoint...
Debian dla-4733 : libapache2-mod-php7.4 - security update
The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4733 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4733-1 [email protected]...
Linux Distros Unpatched Vulnerability : CVE-2026-72718
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - goose is general-purpose AI agent that runs on your machine. Prior to 1.44.0, the goose review command runs the system git executable to gather the diff for...
Linux Distros Unpatched Vulnerability : CVE-2026-73295
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Material for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2.0 until 9.7.7, the mountSearchSuggest function in...
PT-2026-71186
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to add unexpected parameters to a command due to parameter injection...
PT-2026-70996
Insufficient input sanitization in Snowflake Python API snowflake.core versions prior to 1.13.0 allowed confused-deputy privilege escalation through two related weaknesses: path traversal CWE-22 via unencoded .. identifier path segments, and HTTP parameter pollution CWE-141 via unencoded &//=...
PT-2026-71150
Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An attacker can supply matching cookie and request parameter values to bypass CSRF protection, enabling unauthenticated attackers to run command...
PT-2026-71259
CamaleonCMS contains a stored cross-site scripting vulnerability that allows authenticated low-privileged users to execute arbitrary JavaScript in an administrator's browser by injecting unsanitized HTML payloads into the post title parameter during draft creation. Attackers can submit a maliciou...
PT-2026-71149
Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to reflected cross-site scripting in cmd.cgi via the NagFormId parameter. An unauthenticated remote attacker can craft a malicious link that, when followed by an authenticated user, executes arbitrary JavaScript in the victim'...
PT-2026-71017
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which could allow unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone who is tricked into opening a crafted...
PT-2026-71023
The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks an authorization check, allowing any authenticated user such as a Subscriber to perform SQL injection attacks...
