384545 matches found
CVE-2026-105071: Insertion of Sensitive Information Into Sent Data
Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migration & Cloning = 1.5.17 versions...
CVE-2026-106119: Improper Neutralization of Special Elements in Data Query Logic
LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type for an untrusted structured session identifier at runtime, allowing the identifier to be interpreted as a MongoDB query condition rather than as a...
CVE-2026-106109: Improper Limitation of a Pathname to a Restricted Directory
Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home directory, filesystem roots, or symlink-resolved external...
CVE-2026-105865: Improper Limitation of a Pathname to a Restricted Directory
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can update or delete uploads stored locally can cause file cleanup to remove unintended files outside the configured upload...
CVE-2026-106493: Improper Limitation of a Pathname to a Restricted Directory
Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalog providers did not sufficiently validate object paths. A principal able to create or rename objects in a configured Azure Blob Storage or AWS S3 catalog source could cause catalog descriptors to b...
CVE-2026-106455: Server-Side Request Forgery (SSRF)
Backstage is an open framework for building developer portals. From 0.11.12 until 1.14.7 and 1.15.5, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs plugin configuration in techdocs. An authenticated attacker with control over a TechDocs source repository...
CVE-2026-65142: Deserialization of Untrusted Data
NVIDIA Model-Optimizer contains a vulnerability where an attacker may cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure...
CVE-2026-106037: Missing Authentication for Critical Function
Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the Store REST service, which binds to 0.0.0.0 without authentication on any route. Unauthenticated attackers can call routes such as /api/get, /api/put, /api/removeall and /api/mount to read cached KV data with user...
React Router Vulnerable to Cross-Site Scripting (XSS) via Redirect Location Mishandling (CVE-2026-22029)
React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router and Remix v1/v2 SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs...
CVE-2026-105861: Exposure of Sensitive Information to an Unauthorized Actor
Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, authenticated external URL-based upload retrieval can forward authentication data to a redirected destination that was not verified as trusted, potentially exposing a valid session to ...
ROS-20261006-73-0187
The vulnerability in the kernel-lt is related to errors in processing input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
CVE-2026-102157: Authorization Bypass Through User-Controlled Key
An insecure direct object reference IDOR vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user, under specific attack conditions, to access another user's transient data...
PT-2026-107334
Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.12.2 Description Improper access control in the vertex result caching subsystem allows a remote authenticated attacker to obtain sensitive information or inject malicious data. Recommendations Update I...
CVE-2026-42413: Insertion of Sensitive Information Into Sent Data
Unauthenticated Sensitive Data Exposure in Snapshotify – All-in-One Backup & Restore & Migrate = 1.3.2 versions...
Linux Distros Unpatched Vulnerability : CVE-2026-98207
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mmc: spi: reset bytesxfered before retrying CRC failures mmcspidatado updates data-bytesxfered after each block has been transferred successfully. If a later...
RHEL 10 : openssh (RHSA-2026:76748)
The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:76748 advisory. OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files...
CVE-2026-106106: Improper Neutralization of Input During Web Page Generation
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError in utils/render-ssr-error/src/index.js used diagnostic data from utils/render-ssr-error/src/env.js to serialize process.env,...
PT-2026-106468
Unauthenticated Sensitive Data Exposure in SafeSnap – Verified WordPress Backup & Restore = 2.1.2 versions...