326188 matches found
CVE-2026-73088
A flaw was found in Browserslist, a tool for sharing browser and Node.js versions. An attacker could provide specially crafted statistics data, which the tool processes without proper validation. This improper handling of untrusted data can lead to prototype pollution, potentially causing the...
CVE-2026-73288
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-rc.1, RustFS Object Lock enforcement in crates/ecstore/src/bucket/objectlock/objectlocksys.rs lets checkobjectlockfordeletion, deleteprefix, and lifecycle and scanner sweeps treat ConfigNotFound, unreadable .metadata.bin...
CVE-2026-68756
A party with write access to stored session data may affect JFrog Artifactory under specific conditions...
CVE-2026-66377
An unauthenticated user may access restricted repository information under specific conditions...
SQL Injection
Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to SQL Injection via the searchUsers process. An attacker can retrieve sensitive user information, such as user IDs and display names, by submitting...
SQL Injection
Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to SQL Injection via the searchUsers process. An attacker can retrieve sensitive user information, such as user IDs and display names, by submitting...
CVE-2026-47233
Admidio is an open-source user management solution. Version 5.0.9 added a missing isAdministratorInventory gate to case 'itemdelete': in modules/inventory.php. The same fix was not applied to the sibling case 'fielddelete': handler, which destroys an entire inventory field definition, cascading t...
CVE-2026-65926 Private Release Bundle versions may be disclosed under specific configurations
An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known...
CVE-2026-66384
An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions...
CVE-2026-66384
JFrog Artifactory is affected by an improper limitation of a pathname to a restricted directory , allowing an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions. The vulnerability carries a CVSS score of 5.3 (MEDIUM) with high integ...
CVE-2026-66375 Low-privilege users may remove protected Artifactory metadata
A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions...
EUVD-2026-57254
A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions...
EUVD-2026-57252
A party with write access to stored session data may affect JFrog Artifactory under specific conditions...
CVE-2026-68756
CVE-2026-68756 concerns a potential insecure deserialization in JFrog Artifactory. The CVE records indicate that a party with write access to stored session data may affect Artifactory under specific conditions. Connected sources (CVELIST) label the issue as potential insecure deserialization; no...
CVE-2026-68756 Potential insecure deserialization in JFrog Artifactory
A party with write access to stored session data may affect JFrog Artifactory under specific conditions...
CLSA-2026-1786547094 TuxCare security update for org.springframework.data:spring-data-ldap (3 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-ldap to address 3 CVEs. Fixed in 3.2.12-tuxcare.1...
CVE-2026-68755 Bundle writers may alter trusted release information in JFrog Artifactory
A bundle writer may create misleading release promotion information under specific conditions...
ECHO-8274-3DD3-6490
Bulletin has no description...
CVE-2026-73288 RustFS: Object Lock (WORM) protections are treated as absent when bucket metadata cannot be read, allowing retained objects to be deleted
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-rc.1, RustFS Object Lock enforcement in crates/ecstore/src/bucket/objectlock/objectlocksys.rs lets checkobjectlockfordeletion, deleteprefix, and lifecycle and scanner sweeps treat ConfigNotFound, unreadable .metadata.bin...