58883 matches found
Coder < 2.29.7 / 2.30.x < 2.30.2 Workspace Auto-Creation Without Consent (CVE-2026-44454)
The version of Coder installed on the remote host is prior to 2.29.7 or 2.30.x prior to 2.30.2. It is, therefore, affected by a command injection vulnerability. The dotfiles registry module passed unsanitized user input to shell commands, enabling arbitrary code execution inside provisioned...
CVE-2026-44918
OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization...
CVE-2026-44918
OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization...
CVE-2026-12598
creationtimestamp| type| source ---|---|--- 2026-07-09 23:57:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqatkxb6dv26 2026-07-10 02:00:14+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqb2gy4ouu2i...
CVE-2026-12595
creationtimestamp| type| source ---|---|--- 2026-07-09 23:52:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqatbxlm5v2x 2026-07-10 01:00:56+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqax4vap6h2m...
CVE-2026-59269
creationtimestamp| type| source ---|---|--- 2026-07-09 23:09:00+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqaqupneqf2s 2026-07-10 03:34:11+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116893578077059959...
CVE-2026-44787
creationtimestamp| type| source ---|---|--- 2026-07-09 23:04:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqaqmco25h25 2026-07-19 19:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqzjp4zwah26...
CVE-2026-13253
creationtimestamp| type| source ---|---|--- 2026-07-09 22:36:06+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqaozyvdmo2y 2026-07-09 22:36:07+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mqaozzguty2m...
CVE-2026-13334
creationtimestamp| type| source ---|---|--- 2026-07-09 22:33:58+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mqaow6cts72m 2026-07-09 22:34:00+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqaowapx3u22...
CVE-2026-39246
decompress before 4.2.2 allows arbitrary symlink creation during archive extraction. When processing symlink entries type === 'symlink', the x.linkname field from the archive is passed directly to fs.symlink without validation index.js line 121. The preventWritingThroughSymlink check on line 98...
CVE-2026-39243
decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries type === 'link', the x.linkname field from the archive is passed directly to fs.link without validation index.js line 113. An...
GHSA-PX5M-H76G-P7P8
creationtimestamp| type| source ---|---|--- 2026-07-09 22:12:01+00:00| seen| https://gist.github.com/alon710/7957cb9c4dd6636892863390d2a98c29...
CVE-2026-52766
creationtimestamp| type| source ---|---|--- 2026-07-09 21:48:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqame3yhu22w 2026-07-09 22:35:25+00:00| published-proof-of-concept| https://github.com/YesWiki/yeswiki/security/advisories/GHSA-6x7x-gcmf-7r8x...
CVE-2026-54651
creationtimestamp| type| source ---|---|--- 2026-07-09 21:41:51+00:00| seen| https://gist.github.com/alon710/29f907693324d6187f6b141f2c73d47b...
CVE-2026-55605
Summary: CVE-2026-55605 affects the self-hosted HTTP transport of @arikusi/deepseek-mcp-server used with DeepSeek V4. starting in 1.4.2 and before 1.8.0, the POST /mcp endpoint is exposed without authentication due to createMcpExpressApp being called without an authProvider and missing route guar...
CVE-2026-55212 Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation
Pimcore is an Open Source Data & Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, the Studio API class definition creation endpoint POST /pimcore-studio/api/class/definition/configuration-view/detail/create is guarded by the objects permission instead of the classes permission,...
EUVD-2026-42694
Bagisto before 2.4.4 contains a stored cross-site scripting vulnerability via client-side template injection that allows unauthenticated attackers to execute arbitrary JavaScript in administrator browsers by registering a customer account with malicious payload in the first or last name field. Th...
CVE-2026-13492
creationtimestamp| type| source ---|---|--- 2026-07-09 20:21:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqahj5jc7c2x 2026-07-10 00:00:29+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mqatqugq6z23...