328576 matches found
CVE-2026-73039
streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users' viewing status records. Attackers can enumerate all users' watch progress, delete arbitrary viewing history, and manipulate other users'...
CVE-2026-73305
Budibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign called validateGlobalRoleUpdate without checking appBuilder.appId or role.appId in packages/server/src/api/controllers/public/globalRoleValidation.ts. An app-scoped builder could scope the request to ...
CVE-2026-72851
Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTEQUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials,...
DEBIAN-CVE-2026-56858
Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...
CVE-2026-73843 OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/...
CVE-2026-73843 OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/...
CVE-2026-73843
OpenChoreo is vulnerable prior to versions 1.0.2 and 1.1.2 due to unauthenticated access in internal/cluster-gateway/server.go that exposed caller-facing management APIs on the external agent listener. This allows network-reachable attackers to invoke /api/proxy/ and /api/exec/, proxy the data-pl...
CVE-2026-73842
OpenChoreo OpenKubernetes platform vulnerability CVE-2026-73842 affects cluster-gateway internal proxy. Before versions 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certifica...
CVE-2026-72851 Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook
Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTEQUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials,...
CVE-2026-72853 Budibase before 3.40.0 SQL Injection via Oracle connector
Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in identifiers. Attackers with write permission on a table with a double-quote in its name can inject SQL that executes as the datasource's...
Malicious code in wct-st (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3065a54d66ae4872334224443453c85f98c9ab8ae9d87df215bb51a5ba5e7595 On npm install, the package's postinstall lifecycle script collects installer host identifiers hostname, platform, architecture, Node.js version,...
Malicious code in webautomation_js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 854e679284d7396f5ac4f7248839fa3704a2c72bcec08c100267b5980cd2a0d5 index.js is packed with an obfuscator.io RC4 string-array plus self-defending debugger-check wrapper. The only exported function appends a...
CVE-2026-73039
streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users' viewing status records. Attackers can enumerate all users' watch progress, delete arbitrary viewing history, and manipulate other users'...
CVE-2026-73039
CVE-2026-73039 affects the Streama application, via an insecure direct object reference in the ViewingStatusController. The underlying issue allows authenticated users to read and delete other users’ viewing status records, enabling enumeration of all users’ watch progress, deletion of arbitrary ...
CVE-2026-73039 streama Insecure Direct Object Reference via ViewingStatusController
streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users' viewing status records. Attackers can enumerate all users' watch progress, delete arbitrary viewing history, and manipulate other users'...
CVE-2026-73039 streama Insecure Direct Object Reference via ViewingStatusController
streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users' viewing status records. Attackers can enumerate all users' watch progress, delete arbitrary viewing history, and manipulate other users'...
Malicious code in source-analyzer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17c2f07bb4a673bf18d866e697b1a943783696d2871fbc5e5987c2117377e798 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in react-shield (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 407d23edc671619cbd75b7d6ba9aa57d1d7a591669dac19d1c2413a78e586362 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
CVE-2026-18509
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to gain privilege escalation via the Navigator for i debugger. This could allow the attacker to access or manipulate sensitive data on the system, or create new profiles with elevated privileges on the IBM i system...