45063 matches found
CLEANSTART-2026-GO18294 Security fix for CVE-2026-22746 applied in: apache-nifi 2.7.2-r7, cloud-config-server 4.1.7-r2, cloud-config-server 4.2.4-r0, cloud-config-server 4.3.2-r2, cloud-config-server 4.3.4-r0, kafka-ui 1.4.2-r6, rundeck 6.0.0-r0
CVE-2026-22746 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-WO51602 Security fix for CVE-2026-22751 applied in: apache-nifi 2.7.2-r7, cloud-config-server 4.1.7-r2, cloud-config-server 4.2.4-r0, cloud-config-server 4.3.2-r2, cloud-config-server 4.3.4-r0, kafka-ui 1.4.2-r6, rundeck 6.0.0-r0
CVE-2026-22751 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-HO82916 Security fix for GHSA-wx5j-54mm-rqqq applied in: cloud-config-server 4.1.7-r2
Security vulnerability affects the cloud-config-server package. This issue is resolved in later releases. See references for vulnerability details...
WordPress Share-one-Drive | OneDrive & SharePoint plugin for WordPress plugin 2.0-3.8.3 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability
Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by WP Cloud Plugins in WordPress Plugin Share-one-Drive versions 2.0-3.8.3...
Server-Side Request Forgery (SSRF)
io.kestra, core is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of user-controlled HTTP URI destinations, which allows an unauthenticated attacker to import and execute a flow that makes requests to internal services, loopback/link-local...
Server-Side Request Forgery (SSRF)
Nuxt OG Image is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of attacker-controlled font URLs before performing server-side requests, which allows an unauthenticated attacker to access internal services such as loopback, private, link-local,...
Malicious Package
Overview linkedin-cloud is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
CVE-2026-93031: Unrestricted Upload of File with Dangerous Type
The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress are vulnerable to Arbitrary File Upload in all versions from 2.0 up to, and including, 3.8.3 via the downloadfiletouploads function. This is due to the import action being registered for...
CVE-2026-76900: Server-Side Request Forgery (SSRF)
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. In version 1.7.3, ApprovalResourceService.sendWebHook reads WebHookConfig.webHookUrl from stored approval-node configuration and passes it through...
A Multi-Cloud View of Internet Background Radiation
As services are increasingly centralized in public clouds, understanding the nature of Internet Background Radiation IBR hitting these particular environments is an important part of understanding their overall security posture. Classical network telescopes, long the cornerstone of IBR research,...
PT-2026-95435
Name of the Vulnerable Software and Affected Versions IBM Cloud Pak for Data version 5.1.2 Description A remote attacker can perform directory traversal on the system by sending a specially crafted URL request containing "dot dot" sequences /../. This allows the attacker to view arbitrary files o...
PT-2026-102290
Summary In affected versions, the URL of a remote MCP server is attacker-controlled at registration and is fetched server-side with no validation of the destination. There is no guard against loopback, link-local, RFC1918 private ranges, or the cloud metadata endpoint 169.254.169.254, so a use wi...
PT-2026-100697
Security vulnerability affects the cloud-config-server package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-99710
Name of the Vulnerable Software and Affected Versions Obot versions prior to 0.23.0 Description Obot contains a server-side request forgery SSRF issue during remote MCP server registration. Privileged users with Power User, Power User Plus, or Admin roles can specify arbitrary URLs in the...
CVE-2025-14753: Improper Limitation of a Pathname to a Restricted Directory
IBM Cloud Pak for Data 5.1.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system...
Oracle Enterprise Manager Cloud Control (September 2026 CSPU)
The 13.5.0.0 and 24.1.0.0 versions of Enterprise Manager Cloud Control installed on the remote host are affected by multiple vulnerabilities as referenced in the September 2026 CSPU advisory. - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager...
PT-2026-95696
The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress are vulnerable to Arbitrary File Upload in all versions from 2.0 up to, and including, 3.8.3 via the download file to uploads function. This is due to the import action being registered for...
CVE-2025-14754: Improper Neutralization of Special Elements used in an OS Command
IBM Cloud Pak for Data 5.1.2 could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input...
PT-2026-95436
Name of the Vulnerable Software and Affected Versions IBM Cloud Pak for Data version 5.1.2 Description An authenticated user can execute arbitrary commands with elevated privileges on the system. This is caused by improper validation of user supplied input. Recommendations At the moment, there is...