55392 matches found
CVE-2026-79707
A Path Traversal vulnerability in the builder endpoint in Google Cloud Agent Development Kit ADK versions 1.9.0 through 1.21.0 on Python allows an unauthenticated remote attacker to read arbitrary files using a crafted filepath query parameter...
CVE-2026-79707 Arbitrary File Read in Google Agent Development Kit (ADK)
A Path Traversal vulnerability in the builder endpoint in Google Cloud Agent Development Kit ADK versions 1.9.0 through 1.21.0 on Python allows an unauthenticated remote attacker to read arbitrary files using a crafted filepath query parameter...
CVE-2026-79707
A Path Traversal vulnerability in the builder endpoint of Google Cloud Agent Development Kit (ADK) versions 1.9.0 through 1.21.0 (Python) allows an unauthenticated remote attacker to read arbitrary files by supplying a crafted file_path query parameter. The CVSS 4.0 base score is 8.7 (HIGH) , ref...
CVE-2026-79707 Arbitrary File Read in Google Agent Development Kit (ADK)
A Path Traversal vulnerability in the builder endpoint in Google Cloud Agent Development Kit ADK versions 1.9.0 through 1.21.0 on Python allows an unauthenticated remote attacker to read arbitrary files using a crafted filepath query parameter...
EUVD-2026-70994
A Path Traversal vulnerability in the builder endpoint in Google Cloud Agent Development Kit ADK versions 1.9.0 through 1.21.0 on Python allows an unauthenticated remote attacker to read arbitrary files using a crafted filepath query parameter...
EUVD-2026-70974
Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver versions 4.2.0 through 4.3.3 allowed a credential-bearing login request to be redirected to an attacker-selected HTTPS endpoint. An attacker able to control the account value could cause the driver to...
CVE-2026-85528 Snowflake JDBC Driver auto-configuration account validation permits credential redirection
Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver versions 4.2.0 through 4.3.3 allowed a credential-bearing login request to be redirected to an attacker-selected HTTPS endpoint. An attacker able to control the account value could cause the driver to...
noir v1.3.1
Hunt every Endpoint in your code, expose Shadow APIs, map the Attack Surface. Documentation • Installation • Usage • Github Action • Contributing • Changelog Noir is a SAST tool that reads source code and extracts the endpoints an application exposes — paths, methods, parameters, headers, cookies...
CVE-2026-80438
The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read Ninja Forms WordPress...
EUVD-2026-70907
The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read Ninja Forms WordPress...
EUVD-2026-70900
The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach...
EUVD-2026-70817
A weakness has been identified in SpecterOps BloodHound up to 9.5.1. The affected element is the function NewV2API of the file cmd/api/src/api/registration/v2.go of the component Graph Write Endpoint. Executing a manipulation can lead to improper authorization. It is possible to launch the attack...
PT-2026-85579
Name of the Vulnerable Software and Affected Versions Chatbot UI affected versions not specified Description An authorization bypass exists in the retrieval endpoint. Authenticated attackers can access private file content of other users by providing arbitrary file UUIDs. The issue occurs because...
PT-2026-85583
Documenso 2.17.0 contains an access control vulnerability in the PDF-serving endpoint that fails to validate document visibility settings. Attackers with low privileges can read restricted documents within their team or cross-tenant by leveraging missing ownership validation on document data...
PT-2026-85781
PowerJob Worker version 5.1.2 and likely earlier versions exposes the /worker/deployContainer HTTP endpoint without authentication on the default transport port. This allows a remote attacker to execute arbitrary code...
CVE-2026-75429
PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Server-Worker transport layer...
Linux PCI Device Driver Heap Buffer Overflow DoS
The vulnerability of the pciepfallocdoorbell function in the drivers/pci/endpoint/pci-ep-msi.c module of the Linux system’s PCI device driver lies in the fact that the same resource or descriptor is released multiple times. Exploiting this vulnerability could allow an attacker to compromise the...
Linux Distros Unpatched Vulnerability : CVE-2026-76177
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Server-Side Request Forgery SSRF vulnerability in the /ocsreports/?function=teleactivate endpoint due to insufficient validation of the HTTPSSERV and FILESERV...
Linux Distros Unpatched Vulnerability : CVE-2026-76174
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admininfo endpoint. The application validates files solely based o...