213 matches found
CVE-2026-77171
A public shared collective always allowed recipients of the link to create pages...
CVE-2026-77171
A public shared collective always allowed recipients of the link to create pages...
CVE-2026-77171
The Nextcloud Collectives application is vulnerable to an Improper Access Control issue (CWE-284). The vulnerability allows non-members who access a public collective to create new pages via the backend API , effectively bypassing collective-level permission settings that should restrict editing ...
CVE-2026-77171
A public shared collective always allowed recipients of the link to create pages...
PT-2026-126669
A public shared collective always allowed recipients of the link to create pages...
Malicious code in collective-amethyst-pinniped (npm)
Source: amazon-inspector 7a0c65e117306be60ddecd607f8537dc81cf1824f1dfa79a22fe45e8ea2c29e4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in collective-lime-finch (npm)
Source: amazon-inspector d87f72848be2bbc247120017226c1749fab81abc67387137258a35e59952f408 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in collective-gray-minnow (npm)
Source: amazon-inspector ab38bc3008641811ac958af7f76bc6ad5d60ae5a8f96aa8cac967ffb58bda6b4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in collective-black-camel (npm)
Source: amazon-inspector bba28f57509daaef6f5f46f42995d30a516865e558b818eaf4b07c4edcbb4a4a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is affected by a privilege escalation vulnerability (CVE-2026-18499)
Summary IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is affected by a privilege escalation vulnerability with the collectiveController-1.0 or collectiveMember-1.0 enabled. Vulnerability Details Refer to the security bulletins listed in the...
Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, is affected by a privilege escalation vulnerability (CVE-2026-18499)
Summary IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, is affected by a privilege escalation vulnerability with the collectiveController-1.0 or collectiveMember-1.0 enabled. Vulnerability Details Refer to the security bulletins listed in the...
Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM Enterprise Application Runtimes, is affected by a privilege escalation vulnerability (CVE-2026-18499)
Summary IBM WebSphere Application Server Liberty, which is bundled with IBM Enterprise Application Runtimes, is affected by a privilege escalation vulnerability with the collectiveController-1.0 or collectiveMember-1.0 enabled. Vulnerability Details Refer to the security bulletins listed in the...
Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, is affected by a remote code execution and path-segment injection vulnerability (CVE-2026-14976, CVE-2026-15280)
Summary IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, is affected by a remote code execution and path-segment injection vulnerability with the collectiveController-1.0 enabled. Vulnerability Details Refer to the security bulletins listed in the...
Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM Enterprise Application Runtimes, is affected by a remote code execution and path-segment injection vulnerability (CVE-2026-14976, CVE-2026-15280)
Summary IBM WebSphere Application Server Liberty, which is bundled with IBM Enterprise Application Runtimes, is affected by a remote code execution and path-segment injection vulnerability with the collectiveController-1.0 enabled. Vulnerability Details Refer to the security bulletins listed in t...
Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM Enterprise Application Runtimes, is affected by a cross-site request forgery (CVE-2026-14980, CVE-2026-2482)
Summary IBM WebSphere Application Server Liberty, which is bundled with IBM Enterprise Application Runtimes, is affected by a cross-site request forgery vulnerability with the collectiveController-1.0 enabled. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes...
EUVD-2026-51266
SGLang contains a model weight exfiltration vulnerability when no API keys are configured, as SGLang will expose two endpoints that allow a remote attacker to trigger distributed weight broadcasting using NCCL and then triggering data transfer, attackers can exfiltrate all model weights...
CVE-2026-15978 CVE-2026-15978
SGLang contains a model weight exfiltration vulnerability when no API keys are configured, as SGLang will expose two endpoints that allow a remote attacker to trigger distributed weight broadcasting using NCCL and then triggering data transfer, attackers can exfiltrate all model weights...
CVE-2026-14980
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF attacks with elevated privileges when the collectiveController-1.0 feature is enabled...
CVE-2026-14980 IBM WebSphere Application Server Liberty is affected by a cross-site request forgery
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF attacks with elevated privileges when the collectiveController-1.0 feature is enabled...
CVE-2026-14980 IBM WebSphere Application Server Liberty is affected by a cross-site request forgery
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF attacks with elevated privileges when the collectiveController-1.0 feature is enabled...