388878 matches found
CVE-2026-105761
Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps/appid/server endpoint in api/controllers/console/app/mcpserver.py used AppMCPServerController.put to retrieve an AppMCPServer by the client-supplied server ID without verifying that the server belonged...
CVE-2026-105761 Dify: IDOR in AppMCPServer PUT Endpoint Allows Modification of Other Apps' MCP Servers
Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps/appid/server endpoint in api/controllers/console/app/mcpserver.py used AppMCPServerController.put to retrieve an AppMCPServer by the client-supplied server ID without verifying that the server belonged...
CVE-2026-105761
Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps//server endpoint in api/controllers/console/app/mcpserver.py used AppMCPServerController.put to retrieve an AppMCPServer by the client-supplied server ID without verifying that the server belonged to t...
EUVD-2026-92852
Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps/appid/server endpoint in api/controllers/console/app/mcpserver.py used AppMCPServerController.put to retrieve an AppMCPServer by the client-supplied server ID without verifying that the server belonged...
EUVD-2026-90922
GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor...
dbt-schema-builder (>=0.4.3, <=0.4.4), dbt-snowflake (>=1.0.0rc1, <=1.0.1) +2 more potentially affected by CVE-2026-86597 via snowflake-connector-python (2.7.10)
snowflake-connector-python PYPI version 2.7.10 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - dbt-schema-builder =0.4.3, =1.0.0rc1, =0.1.1, =0.2.7 - elementary-lineage 0.1.0 Source cves: CVE-2026-86597...
meltanolabs-tap-snowflake (>=0.2.0, <=0.3.0), snowflake-data-exchange-agent (>=0.0.21, <=1.0.1) potentially affected by CVE-2026-86597 via snowflake-connector-python (3.17.4)
snowflake-connector-python PYPI version 3.17.4 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - meltanolabs-tap-snowflake =0.2.0, =0.0.21, =1.0.1 Source cves: CVE-2026-86597 Source advisory:...
org.apache.nifi:nifi-snowflake-processors (2.8.0), org.apache.nifi:nifi-snowflake-processors-nar (2.8.0) +5 more potentially affected by CVE-2026-86597 via net.snowflake:snowflake-jdbc-thin (3.28.0)
net.snowflake:snowflake-jdbc-thin MAVEN version 3.28.0 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc-thin and may be impacted: - org.apache.nifi:nifi-snowflake-processors 2.8.0 -...
io.github.zoom-dustin-moriarty:zoom-data-fence (1.0.0), net.snowflake:snowflake-ingest-sdk (>=4.0.1-unshaded, <=4.1.0-unshaded) +1 more potentially affected by CVE-2026-86597 via net.snowflake:snowflake-jdbc-thin (3.24.2)
net.snowflake:snowflake-jdbc-thin MAVEN version 3.24.2 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc-thin and may be impacted: - io.github.zoom-dustin-moriarty:zoom-data-fence 1.0.0 - net.snowflake:snowflake-ingest-sdk...
EUVD-2026-81596
vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool...
grafana: grafana: Information disclosure via unrevoked access tokens in paused shared dashboards
A flaw was found in Grafana. This vulnerability allows information disclosure because pausing a shared dashboard fails to revoke access tokens for endpoints serving initialization data. An unauthenticated remote attacker possessing the link to a paused dashboard can exploit this flaw to retrieve...
grafana: grafana: Information disclosure via unrevoked access tokens in paused shared dashboards
A flaw was found in Grafana. This vulnerability allows information disclosure because pausing a shared dashboard fails to revoke access tokens for endpoints serving initialization data. An unauthenticated remote attacker possessing the link to a paused dashboard can exploit this flaw to retrieve...
CVE-2026-21589
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific fil...
CVE-2026-21589
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific fil...
CVE-2026-21589
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific fil...
CVE-2026-21589
CVE-2026-21589 is a critical (CVSS 4.0: 9.3) pre-authentication arbitrary file read vulnerability affecting multiple Atlassian Data Center products, including Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye. The root cause lies in the shared atlassian-plugins-webresource library...
Unsynchronized Access to Shared Data in a Multithreaded Context
Overview Affected versions of this package are vulnerable to Unsynchronized Access to Shared Data in a Multithreaded Context through the container lifecycle handling in frontend/gateway/container/container.go and frontend/gateway/forwarder/forward.go. A malicious external BuildKit frontend can...
Unsynchronized Access to Shared Data in a Multithreaded Context
Overview Affected versions of this package are vulnerable to Unsynchronized Access to Shared Data in a Multithreaded Context through the container lifecycle handling in frontend/gateway/container/container.go and frontend/gateway/forwarder/forward.go. A malicious external BuildKit frontend can...
