356830 matches found
CVE-2026-79537: Authorization Bypass Through User-Controlled Key
metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference IDOR in the MCP transport session dispatch. The session store getSession in session-lifetime-manager.ts is keyed only by the client-supplied mcp-session-id header with no owner, namespace, or endpoint binding, and the...
CVE-2026-84422: Improper Neutralization of Special Elements used in an OS Command
IBM Guardium Data Protection 12.2 is vulnerable to command injection in the CLI certificate SMIME recipient deletion functionality, allowing an authenticated privileged CLI user to execute arbitrary commands with root privileges...
EUVD-2026-89362
metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference IDOR in the MCP transport session dispatch. The session store getSession in session-lifetime-manager.ts is keyed only by the client-supplied mcp-session-id header with no owner, namespace, or endpoint binding, and the...
CVE-2026-100286: Exposure of Sensitive Information to an Unauthorized Actor
Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrative user to disclose integration secrets via a crafted API request...
FreeBSD: VID-bd24bc14-b9a9-11f1-bf98-a8a1599412c6 (CVE-2026-95368): chromium -- security fixes
Incorrect authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially obtain cross-origin data via a crafted HTML page. Chromium security severity: Low...
PT-2026-102799
Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description An issue exists in the CLI certificate SMIME recipient deletion functionality that allows an authenticated privileged CLI user to perform command injection. This can lead to the execution o...
COPA-DATA zenon Remote Transport Service Missing Authentication for Critical Function (CVE-2025-8754)
Binary data copadatazenoncve-2025-8754.nbin...
CVE-2026-81841: Missing Authorization
Pausing a shared public dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credential...
Paused shared dashboard access tokens still expose data source configuration
Pausing a shared public dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credential...
CVE-2026-102300: Use of Uninitialized Resource
Uninitialized resource in WebGPU in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...
CVE-2026-81914: Improper Neutralization of Special Elements in Data Query Logic
Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore terminated the literal early and appended...
PT-2026-102833
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 154.0.8037.92 Description An uninitialized resource in WebGPU allows a remote attacker to obtain cross-origin data by using a crafted HTML page. WebGPU is a modern API that provides high-performance graphics and...
CVE-2026-76731: Improper Privilege Management
An authentication bypass vulnerability in the captive portal of HPE Networking Instant On could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain limited access to some data and to make limited changes...
Oracle Linux 10 : openssh (ELSA-2026-69129)
The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-69129 advisory. - CVE-2026-73283: Complete the fix of security bypass due to incorrect handling of forwarding and tunneling options Resolves: RHEL-245413 -...
CVE-2026-95368: Incorrect Authorization
Incorrect authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially obtain cross-origin data via a crafted HTML page. Chromium security severity: Low...
CVE-2026-102303: Use of Uninitialized Resource
Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...
PT-2026-102422
Name of the Vulnerable Software and Affected Versions GestSup versions prior to 3.2.62 Description Authenticated attackers can read private comments from tickets belonging to other users without proper authorization. This occurs because the application fails to validate ticket ownership when...
CVE-2026-84154: Improper Control of Generation of Code
A Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x could allow an attacker to execute arbitrary code on the server...
CVE-2026-102728: Buffer Over-read
Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a server-supplied message before validating that the message is long enough to contain them. Both are bounded out-of-bounds reads on a remotely reachable path, both are reached from a TLS or DTLS client connecting to a...
FreeBSD: VID-bd24bc14-b9a9-11f1-bf98-a8a1599412c6 (CVE-2026-95289): chromium -- security fixes
Incorrect authorization in Scroll in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...