40132 matches found
CVE-2026-66794
A flaw was found in the "cluster-proxy-addon" component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy...
CVE-2026-66794 Cluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public route
A flaw was found in the cluster-proxy-addon component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy...
CVE-2026-66794
A flaw was found in the cluster-proxy-addon component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy...
CVE-2026-72712
A flaw was found in Nmap. A remote attacker can exploit this denial of service vulnerability by sending a specially crafted packet that includes a zero-length Transmission Control Protocol TCP option. This malformed packet forces the application to enter an infinite loop during packet processing,...
Malware in express-request-engine
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malicious Package
Overview express-request-engine is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...
Malicious Package
Overview express-route-engine is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
EUVD-2026-62465
ArcadeDB before 26.8.1 arcadedb-gremlin, affected = 26.7.3 contains a remote code execution vulnerability in its Gremlin query engine. Although the engine defaults to the documented-secure java gremlin-lang engine, ArcadeGremlin.executeStatement silently falls back to the insecure Groovy engine...
CVE-2026-76224 ArcadeDB before 26.8.1 Remote Code Execution via Groovy Fallback
ArcadeDB before 26.8.1 arcadedb-gremlin, affected = 26.7.3 contains a remote code execution vulnerability in its Gremlin query engine. Although the engine defaults to the documented-secure java gremlin-lang engine, ArcadeGremlin.executeStatement silently falls back to the insecure Groovy engine...
com.arcadedb:arcadedb-bolt (>=26.2.1, <=26.7.3), com.arcadedb:arcadedb-console (>=21.9.1-beta, <=26.7.3) +22 more potentially affected by CVE-2026-76225 via com.arcadedb:arcadedb-engine (>=21.9.1-beta, <=26.7.3)
com.arcadedb:arcadedb-engine MAVEN version =21.9.1-beta, =26.2.1, =21.9.1-beta, =21.9.1-beta, =21.12.1, =21.9.1-beta, =25.9.1, =25.9.1, =25.9.1, =26.4.2, =21.9.1-beta, =25.1.1, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =26.7.3 and more Source cves: CVE-2026-76225 Source advisory:...
CVE-2026-76224 ArcadeDB before 26.8.1 Remote Code Execution via Groovy Fallback
ArcadeDB before 26.8.1 arcadedb-gremlin, affected = 26.7.3 contains a remote code execution vulnerability in its Gremlin query engine. Although the engine defaults to the documented-secure java gremlin-lang engine, ArcadeGremlin.executeStatement silently falls back to the insecure Groovy engine...
CVE-2026-76224
ArcadeDB before 26.8.1 arcadedb-gremlin, affected = 26.7.3 contains a remote code execution vulnerability in its Gremlin query engine. Although the engine defaults to the documented-secure java gremlin-lang engine, ArcadeGremlin.executeStatement silently falls back to the insecure Groovy engine...
CVE-2026-76224 ArcadeDB before 26.8.1 Remote Code Execution via Groovy Fallback
ArcadeDB before 26.8.1 arcadedb-gremlin, affected = 26.7.3 contains a remote code execution vulnerability in its Gremlin query engine. Although the engine defaults to the documented-secure java gremlin-lang engine, ArcadeGremlin.executeStatement silently falls back to the insecure Groovy engine...
CVE-2026-76224
ArcadeDB (arcadedb-gremlin, versions ≤ 26.7.3) contains a remote code execution vulnerability in its Gremlin query engine. The root cause is that ArcadeGremlin.executeStatement() silently falls back to the insecure Groovy engine whenever a request carries any query parameter and the query does no...
com.arcadedb:arcadedb-bolt (>=26.2.1, <=26.7.3), com.arcadedb:arcadedb-console (>=21.9.1-beta, <=26.7.3) +22 more potentially affected by CVE-2026-76223 via com.arcadedb:arcadedb-engine (>=21.9.1-beta, <=26.7.3)
com.arcadedb:arcadedb-engine MAVEN version =21.9.1-beta, =26.2.1, =21.9.1-beta, =21.9.1-beta, =21.12.1, =21.9.1-beta, =25.9.1, =25.9.1, =25.9.1, =26.4.2, =21.9.1-beta, =25.1.1, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =26.7.3 and more Source cves: CVE-2026-76223 Source advisory:...
CVE-2026-76047
A flaw was found in chromium-browser. A remote attacker could exploit a type confusion vulnerability in the V8 JavaScript engine by enticing a user to visit a specially crafted HTML page. This could allow the attacker to execute arbitrary code within the browser's sandbox, potentially compromisin...
BIT-MONGODB-2026-13078 Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader
A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit...
CVE-2026-74976
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: JIT miscompilation in the JavaScript Engine: JIT component...
CVE-2026-76039
creationtimestamp| type| source ---|---|--- 2026-08-19 04:47:56+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260819 2026-09-16 04:46:46+00:00| seen| https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities20260916...