1451 matches found
CVE-2026-84833 ntegrals openbrowser Browser Agent Message Construction agent.ts resource consumption
A vulnerability was found in ntegrals openbrowser up to 067fc45d649baa961750da8e2f4a75d87c5c75c8. Affected by this vulnerability is an unknown functionality of the file packages/core/src/agent/agent.ts of the component Browser Agent Message Construction. Performing a manipulation results in...
WordPress Under Construction plugin <= 5.82 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Under Construction versions = 5.82...
CVE-2026-84833: Uncontrolled Resource Consumption
A vulnerability was found in ntegrals openbrowser up to 067fc45d649baa961750da8e2f4a75d87c5c75c8. Affected by this vulnerability is an unknown functionality of the file packages/core/src/agent/agent.ts of the component Browser Agent Message Construction. Performing a manipulation results in...
PT-2026-84839
A vulnerability was found in ntegrals openbrowser up to 067fc45d649baa961750da8e2f4a75d87c5c75c8. Affected by this vulnerability is an unknown functionality of the file packages/core/src/agent/agent.ts of the component Browser Agent Message Construction. Performing a manipulation results in...
EUVD-2026-69289
ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Attackers can craft malicious model repositories with poisoned configuration files that execute code when loaded by users...
Arbitrary Code Injection
Overview modelscope is a ModelScope: bring the notion of Model-as-a-Service to life. Affected versions of this package are vulnerable to Arbitrary Code Injection due to unsafe YAML deserialization in the model configuration loading paths in modelscope/models/audio/tts/voice.py and...
PT-2026-83879
The affected Ebyte product uses a deprecated hashing algorithm in an authentication-related operation. Under conditions where an attacker can manipulate or predict the authentication exchange, the weak construction may reduce the assurance provided by the authentication mechanism and facilitate...
CVE-2026-81529 Connection-option injection via unescaped settings in the canonical MongoDB URL builder
Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C Driver. When an application passes untrusted text into the driver's connection-URL builder and round-trips the builder back into a client configuration, the untrusted text is...
Security Bulletin: Multiple vulnerabilities in IBM Observability with Instana (OnPrem)
Summary Multiple vulnerabilities were addressed in IBM Observability with Instana OnPrem build 1.0.323 Vulnerability Details CVEID:CVE-2026-48776 DESCRIPTION: LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python...
CVE-2026-81820
Flowintel versions greater than 3.3.0 are vulnerable to HTML injection in the MISP case history timeline. Attacker-controllable MISP object fields (object UUID, name, attribute value, attribute type, comment, first/last seen, and IDS flag) were concatenated directly into HTML strings before rende...
CVE-2026-81820 Flowintel HTML Injection in MISP Case History Timeline via Crafted Object Attributes
Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as: object UUID; object name; attribute value; attribute type; comment; first/last seen values; IDS flag. Those values were concatenated directly into HTML strings before rendering. The...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: resteasy (UTSA-2026-032352)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-032352 advisory. A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation result...
CVE-2026-19912
The Kaltura HTML5 player mwEmbed / html5lib contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction. mwEmbedLoader.php accepts a user‑controlled ServiceUrl, whose response is passed to unserialize, and the...
PT-2026-81394
Name of the Vulnerable Software and Affected Versions html5lib versions 2.x and earlier Description The Kaltura HTML5 player mwEmbed / html5lib contains an unauthenticated remote code execution issue resulting from unsafe data deserialization and unsanitized filesystem path construction. The...
CVE-2026-19912: Improper Input Validation
The Kaltura HTML5 player mwEmbed / html5lib contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction. mwEmbedLoader.php accepts a user‑controlled ServiceUrl, whose response is passed to unserialize, and the...
CVE-2026-45698
Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the deletedir function of Netatalk's afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for pat...
CVE-2026-54284
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by groupparenthesis and groupcase, causing quadratic CPU consumption through sqlparse.parse,...
CVE-2026-72104
The CVE-2026-72104 entry concerns the Linux kernel component dm-pcache (pcache target). The vulnerability arises when optional arguments are parsed as name/value pairs and a table advertises an option (e.g., cache_mode) but provides only the option name; after consuming the name, the parser decre...
CVE-2026-72104 dm-pcache: reject option groups without values
In the Linux kernel, the following vulnerability has been resolved: dm-pcache: reject option groups without values The pcache target parses optional arguments as name/value pairs. A table that advertises one optional argument and supplies only a recognized option name, for example "cachemode",...
