865715 matches found
CGA-7JP3-8H84-VHCJ
Bulletin has no description...
CGA-FJ7F-JV92-8W2W
Bulletin has no description...
CGA-4W2X-WXXJ-5GW7
Bulletin has no description...
CGA-V5JJ-R4XW-FG97
Bulletin has no description...
CGA-X23X-VGV2-5V7G
Bulletin has no description...
CGA-V34Q-9FQQ-XCV2
Bulletin has no description...
CVE-2026-93517
A heap buffer overflow in handling GLX RenderLarge request where dataBytes exceeds cmdlen in X.org X server before 21.1.25 and XWayland before 24.1.14 that could be be triggered by an authenticated X client could cause crashes or code execution in X server context...
CGA-2MRG-FJ76-2JW5
Bulletin has no description...
CGA-CHJG-XFR2-2877
Bulletin has no description...
CVE-2026-59185
identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes. Prior to 1.0.2, the default-on POST /v1/workspaces/:workspaceid/projects/:projectid/github/connect/complete endpoint in internal/api/router.go accepts installationid from the request body or...
CVE-2026-59959
SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to version 1.0.2, the built-in WebP decoder can crash during loader initialization when processing a malformed animated WebP file with inconsistent container or ANMF frame...
CVE-2026-52729
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on PUT/DELETE /action/id allow an authenticated user to modify or delete actions on any Layout. Exploitation requires the privile...
CVE-2026-59164
NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, nora-registry authenticates the token-management UI but fails to require administrator authorization. authmiddleware protects /ui/tokens and /api/ui/tokens, but state-changing requests are checked only with...
CVE-2026-59177
ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to 1.0.10, the Home Assistant add-on's trusted ingress site binds to 0.0.0.0 while intentionally skipping dashboard authentication because the supervisor is expected to authenticate requests upstream...
CVE-2026-59172
Joker is a small Clojure interpreter, linter and formatter written in Go. Prior to 1.8.2, joker --lint walks upward from the linted file to locate a .jokerd/ directory and executes matching linter. files before linting. Those files contain executable Joker/Clojure code, so linting a file inside a...
CVE-2026-59176
Functype is a family of TypeScript functional programming libraries. Prior to 1.4.4, the setfunctypeversion MCP tool in functype-mcp-server accepts an unconstrained version string using only z.string validation in packages/mcp-server/src/index.ts and interpolates it into functype@ for pnpm add...
CVE-2026-59179
OpenHop is a tool for creating interactive data-flow diagrams. Prior to 0.3.7, @openhop/server passes unauthenticated flow route parameters from GET /api/flows/:id and DELETE /api/flows/:id in packages/server/src/routes.ts to FlowStore.filePath in packages/server/src/store.ts without an identifie...
CVE-2026-50541
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on GET /dataset/export/csv/id allow an authenticated user to export data from any dataset, including datasets created by...
CVE-2026-116078
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames. doreaddata/5 in lib/bandit/http2/stream.ex keeps every DATA...
