44197 matches found
EUVD-2026-101027
Cloud Commander cloudcmd versions 19.20.2 through 19.21.1 contains a path traversal vulnerability in the GET /api/v1/pack endpoint where the onGET handler at server/rest/index.js:130 calls the unguarded root function instead of the root.resolve validation wrapper used elsewhere. Attackers can sen...
CVE-2026-110652 ONLYOFFICE DocumentServer before 10.0.0 SSRF via downloadfile isInJwtToken Bypass
ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vulnerability in the /downloadfile/:docid endpoint that allows remote attackers to bypass the private-IP request-filtering-agent by exploiting the isInJwtToken flag when JWT verification is disabled in...
CVE-2026-85298
An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integration versions prior to 2026-08-27 allows an authenticated user to escalate privileges and impersonate a service account in the project. This vulnerability was...
CVE-2026-85298
The Google Cloud Application Integration service (versions prior to 2026-08-27 ) is vulnerable to an Incorrect Authorization vulnerability. The root cause exists in the AuthConfig validation and integration execution runtime , which allows an authenticated user to perform privilege escalation and...
EUVD-2026-101004
An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integration versions prior to 2026-08-27 allows an authenticated user to escalate privileges and impersonate a service account in the project. This vulnerability was...
CVE-2026-85298 Improper Authorization in Google Cloud Application Integration Leads to Privilege Escalation
An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integration versions prior to 2026-08-27 allows an authenticated user to escalate privileges and impersonate a service account in the project. This vulnerability was...
CVE-2026-0311: Server-Side Request Forgery (SSRF)
A server-side request forgery vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local unauthenticated user to make unauthorized network requests from host to internal services...
CVE-2026-110690: Relative Path Traversal
Cloud Commander cloudcmd versions 19.20.2 through 19.21.1 contains a path traversal vulnerability in the GET /api/v1/pack endpoint where the onGET handler at server/rest/index.js:130 calls the unguarded root function instead of the root.resolve validation wrapper used elsewhere. Attackers can sen...
CVE-2026-0312: Improper Limitation of a Pathname to a Restricted Directory
Path traversal vulnerabilities in Palo Alto Networks Checkov by Prisma® Cloud enable an unauthenticated local user to write files to arbitrary locations on the scanning filesystem...
CVE-2026-110652: Server-Side Request Forgery (SSRF)
ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vulnerability in the /downloadfile/:docid endpoint that allows remote attackers to bypass the private-IP request-filtering-agent by exploiting the isInJwtToken flag when JWT verification is disabled in...
CVE-2026-110628: Server-Side Request Forgery (SSRF)
Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch to read internal services, localho...
CVE-2026-110621: Missing Authorization
Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own organisation. Attackers can create an organisation and add a victim project by its public tracking I...
CVE-2026-100169: Improper Authentication
Improper Authentication in the social account linking path of the Prowler API in Prowler from 5.4.0 before 5.35.0 allows a remote unauthenticated attacker to obtain persistent access to the account of a user who has not yet registered, because ProwlerSocialAccountAdapter.presociallogin in...
PT-2026-114063
Name of the Vulnerable Software and Affected Versions Swetrix Cloud versions prior to 5.1.0 Description An authorization flaw exists in the addProject function within the ProjectController. This issue allows authenticated users to hijack arbitrary projects by moving them into an organization they...
CVE-2026-55385: Server-Side Request Forgery (SSRF)
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf's PDFConfigurationRequest.php validates the owner-controlled gotenberghost setting only as a syntactically valid URL...
CVE-2026-55787: Server-Side Request Forgery (SSRF)
Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.3, validateurlssrf and isprivateip in src/core/utils.py compare resolved addresses only against native private IPv4 and IPv6 ranges and do not unwrap IPv4-mapped, IPv4-compatible, 6to4, or NAT64 transition...
CVE-2026-85298: Incorrect Authorization
An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integration versions prior to 2026-08-27 allows an authenticated user to escalate privileges and impersonate a service account in the project. This vulnerability was...
Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: tomcat (UTSA-2026-130156)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130156 advisory. Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token...