132544 matches found
CVE-2026-50105 RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
RSS/Atom feed handlers bypass API-token scope & public-only confinement incomplete fix of 37698...
CVE-2026-50105
RSS/Atom feed handlers bypass API-token scope & public-only confinement incomplete fix of 37698...
CVE-2026-50105
The CVE-2026-50105 entry concerns Gitea: RSS/Atom feed handlers bypass API-token scope and public‑only confinement (an incomplete fix of #37698). Public sources in the connected documents describe a access-control weakness in the feed handling component that can bypass token scope checks, enablin...
CVE-2026-50105 RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
RSS/Atom feed handlers bypass API-token scope & public-only confinement incomplete fix of 37698...
CVE-2026-50105 RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
RSS/Atom feed handlers bypass API-token scope & public-only confinement incomplete fix of 37698...
MGASA-2026-0334 Updated qemu packages fix many security vulnerabilities
This update to qemu-10.2.4-2.mga10 fixes 14 CVEs from 10.2.3 and 2 from 10.2.4...
CVE-2026-73557
vLLM is an inference and serving engine for large language models. From 0.20.2rc0 until 0.26.0, safeloadpromptembeds in vllm/renderers/embedutils.py uses torch.sparse.checksparsetensorinvariants, whose process-global save, enable, and restore state can be raced by concurrent promptembeds parts...
CVE-2026-49856 @jshookmcp/jshook: ICMP probe and traceroute skip local-network SSRF authorization
@jshookmcp/jshook is an MCP server that gives AI agents tools for JavaScript analysis and security research. In version 0.3.1, he network domain has a central SSRF authorization policy that blocks private, loopback, link-local, and reserved targets unless an explicit authorization object allows...
EUVD-2026-58053
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the validationexceptionhandler in vllm/entrypoints/openai/serverutils.py converts FastAPI RequestValidationError objects with strexc, and sanitizemessage in vllm/entrypoints/utils.py does not remove traceback-styl...
Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892)
Summary The allow-list fix for CVE-2026-31892 GHSA-3wf5-g532-rcrr, and its follow-up coverage of hostNetwork/securityContext/serviceAccountName in GHSA-3775-99mw-8rp4, is incomplete. workflow/util/merge.go ValidateUserOverrides / SanitizeUserWorkflowSpec walk only the top-level fields of...
Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name
Summary A missing end anchor $ in the ClassDefinition UID validation regex allows an authenticated user with the objects permission to create a class with a malicious UID containing SQL. When a data object of that class is later loaded, Block.php concatenates the raw classId directly into a SQL...
CLEANSTART-2026-ZL34069 Security fixes in cortex 1.20.1-r2
Package cortex version 1.20.1-r2 fixes 1 vulnerabilities: ghsa-hrxh-6v49-42gf...
CLEANSTART-2026-ES11075 Security fixes in argo-events 1.9.10-r1
Package argo-events version 1.9.10-r1 fixes 17 vulnerabilities: ghsa-p77j-4mvh-x3m3, ghsa-hrxh-6v49-42gf, CVE-2026-33186, ghsa-mh2q-q3fh-2475, CVE-2026-29181...
CLEANSTART-2026-EL49045 Security fixes in velero-plugin-for-gcp-fips 1.14.2-r1
Package velero-plugin-for-gcp-fips version 1.14.2-r1 fixes 2 vulnerabilities: CVE-2026-39822, CVE-2026-42505...
CLEANSTART-2026-EU00318 Security fixes in argo-workflows 3.7.17-r1
Package argo-workflows version 3.7.17-r1 fixes 16 vulnerabilities: ghsa-3ppc-4f35-3m26, ghsa-7r86-cg39-jmmj, ghsa-23c5-xmqv-rm74, ghsa-xv26-6w52-cph6, ghsa-q3j6-qgpj-74h6...
CLEANSTART-2026-TD64731 Security fixes in fulcio 1.8.7-r2
Package fulcio version 1.8.7-r2 fixes 3 vulnerabilities: ghsa-vgwf-h737-ff37, ghsa-f5wc-c3c7-36mc, ghsa-5cgq-3rg8-m6cv...
CLEANSTART-2026-YY19713 Security fixes in keycloak 26.7.0-r1
Package keycloak version 26.7.0-r1 fixes 13 vulnerabilities: ghsa-rmj7-2vxq-3g9f, ghsa-j3rv-43j4-c7qm, ghsa-9fxm-vc8v-hj55, ghsa-5hh8-q8hv-fr38, ghsa-rcqc-6cw3-h962...
CLEANSTART-2026-VU50374 Security fixes in boring-registry-fips 0.15.5-r1
Package boring-registry-fips version 0.15.5-r1 fixes 2 vulnerabilities: CVE-2025-30204, ghsa-mh63-6h87-95cp...