40677 matches found
CVE-2026-45378: Exposure of Sensitive Information to an Unauthorized Actor
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin UI embeds verificationattachment blobs through reusable signed Active Storage disk URLs, allowing anyone who obtains a URL to...
EulerOS 2.0 SP13 : python-pillow (EulerOS-SA-2026-2992)
According to the versions of the python-pillow packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the...
MINI-WMQV-WFR7-RWQ8
Bulletin has no description...
CVE-2026-18954
Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server before 1.0.12 might allow an authenticated MCP client to perform inappropriate write operations on the connected database via write-capable aggregation pipeline stages that bypass the read-only mode...
CGA-5MQM-MJ4F-FQ4H
Bulletin has no description...
CGA-987Q-F322-CC7W
Bulletin has no description...
CGA-WP83-H2QW-MJWQ
Bulletin has no description...
CGA-9WMP-7M5M-6G4H
Bulletin has no description...
CGA-H2HV-MRJH-QQX7
Bulletin has no description...
CVE-2026-8709
An improper privilege management vulnerability in the REST API document patch operation of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges and execute privileged operations against the Security database...
CVE-2026-8709 Privilege escalation in Progress MarkLogic Server REST document patch operation
An improper privilege management vulnerability in the REST API document patch operation of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges and execute privileged operations against the Security database...
EUVD-2026-53422
An improper privilege management vulnerability in the REST API document processing pipeline of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with an administrative REST role to escalate privileges. This can result in unauthorized disclosure of sensitive server-si...
CVE-2026-7327
The CVE covers Progress MarkLogic Server REST API: an improper privilege management in the REST API document processing pipeline allows an authenticated user with an administrative REST role to escalate privileges, potentially exposing sensitive server-side data. Affected versions are MarkLogic S...
CVE-2026-7327 Privilege escalation in Progress MarkLogic Server REST API document processing
An improper privilege management vulnerability in the REST API document processing pipeline of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with an administrative REST role to escalate privileges. This can result in unauthorized disclosure of sensitive server-si...
MINI-JVJ9-4WCG-CJR5
Bulletin has no description...
MINI-8PQ7-G5HQ-3MJH
Bulletin has no description...
Astra Linux – Vulnerability in Firefox
Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11...
CVE-2026-71247
Documenso's sign-field-with-token.ts, used by the live document-signing UI, allows a recipient with the ASSISTANT role to fetch and complete fields belonging to any later-or-equal-order, not-yet-signed recipient in the same envelope, with no restriction on field type. A newer V2 signing path...
CVE-2026-71247
Documenso's sign-field-with-token.ts, used by the live document-signing UI, allows a recipient with the ASSISTANT role to fetch and complete fields belonging to any later-or-equal-order, not-yet-signed recipient in the same envelope, with no restriction on field type. The handler upserts a...