25422 matches found
PT-2026-68106
Name of the Vulnerable Software and Affected Versions DjangoCRM affected versions not specified Description The toggle default sorting view in common/urls.py lacks authentication wrappers such as login required or staff member required. The view redirects to a destination specified by the next ur...
Linux Distros Unpatched Vulnerability : CVE-2026-71192
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers X-Copy-From, X-Copy-From-Account from S3 API requests whe...
CVE-2026-67860
open62541 1.5.5 contains a heap-based buffer overflow in the default HistoryRead path when the default history database is used with the memory backend...
CVE-2026-67860
open62541 1.5.5 contains a heap-based buffer overflow in the default HistoryRead path when the default history database is used with the memory backend...
CVE-2026-66902
Google::Auth versions before 0.06 for Perl run a command named in an externalaccount credentials JSON via an ungated system call. The Pluggable subclass reads credentialsource.executable.command from the credentials JSON and runs it as "system$command", a single argument call that passes the whol...
CVE-2026-10032
The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary...
CVE-2026-10032
The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary...
CVE-2026-10032 Arbitrary JavaScript Execution via openUrl in @a2ui/web_core
The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary...
NPM: Flowise: IDOR vulnerability exists at the GET /api/v1/organization/customer-default-source endpoint
NPM: Flowise: IDOR vulnerability exists at the GET /api/v1/organization/customer-default-source endpoint discovered by ? in WordPress Npm flowise versions = 3.1.2...
`datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema field
Summarydatamodel-code-generator is vulnerable to code injection when generating Python models from an attacker-controlled JSON Schema, OpenAPI, YAML, JSON, Avro, Protobuf, or XSD schema. When a property carries a "defaultfactory" key, its value is interpolated verbatim — as a raw Python expressio...
PYSEC-2026-3614 pytonapi has a Webhook Custom Path Authentication Bypass
Webhook Custom Path Authentication Bypass in pytonapi Summary TonapiWebhookDispatcher in pytonapi 2.2.0 fails to validate the Authorization header when a webhook handler is registered with the documented path= argument. During setup, bearer tokens are stored only under the default suffix paths...
pytonapi has a Webhook Custom Path Authentication Bypass
Webhook Custom Path Authentication Bypass in pytonapi SummaryTonapiWebhookDispatcher in pytonapi 2.2.0 fails to validate the Authorization header when a webhook handler is registered with the documented path= argument. During setup, bearer tokens are stored only under the default suffix paths e.g...
PYSEC-2026-3596 Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config
Summary Two regexes in backend/openwebui/utils/middleware.py that parse skill-mention tags backtrack in On² on input that contains . Both run synchronously, on the asyncio event loop, on every chat completion with no feature gate. Because the default deployment is a single uvicorn worker, one suc...
Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config
SummaryTwo regexes in backend/openwebui/utils/middleware.py that parse skill-mention tags backtrack in On² on input that contains . Both run synchronously, on the asyncio event loop, on every chat completion with no feature gate. Because the default deployment is a single uvicorn worker, one such...
EUVD-2026-52598
The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect handler, passing a decoded request URI to an unsafe redirect function, which allows unauthenticated attackers to redirect visitors to an arbitrary external URL when a non-defaul...
CVE-2026-16296 Clearfy < 2.4.3 - Open Redirect via Cyrlitera 404 Handler
The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect handler, passing a decoded request URI to an unsafe redirect function, which allows unauthenticated attackers to redirect visitors to an arbitrary external URL when a non-defaul...
CVE-2026-16296
The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect handler, passing a decoded request URI to an unsafe redirect function, which allows unauthenticated attackers to redirect visitors to an arbitrary external URL when a non-defaul...
Sharp Network Scanner Tool insecure initial configuration
Overview Network Scanner Tool and Network Scanner Tool Lite provided by Sharp Corporation are Windows applications which work as FTP servers and accept scan outputs from MFPs. With the initial configuration, anyone can upload files unlimitedly without authentication. Initialization of a Resource...
sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation
A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...
