org.openidentityplatform.opendj:opendj-dsml-servlet (4.4.12), org.openidentityplatform.opendj:opendj-embedded-server-examples (4.4.12) +2 more potentially affected by CVE-2026-46495 via org.openidentityplatform.opendj:opendj-server-legacy (4.4.12)

org.openidentityplatform.opendj:opendj-server-legacy MAVEN version 4.4.12 is affected by a known vulnerability. The following packages have a transitive dependency on org.openidentityplatform.opendj:opendj-server-legacy and may be impacted: - org.openidentityplatform.opendj:opendj-dsml-servlet...

org.openidentityplatform.opendj:opendj-dsml-servlet (4.5.6), org.openidentityplatform.opendj:opendj-embedded-server-examples (4.5.6) +3 more potentially affected by CVE-2026-46495 via org.openidentityplatform.opendj:opendj-server-legacy (4.5.6)

org.openidentityplatform.opendj:opendj-server-legacy MAVEN version 4.5.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.openidentityplatform.opendj:opendj-server-legacy and may be impacted: - org.openidentityplatform.opendj:opendj-dsml-servlet 4.5...

org.openidentityplatform.opendj:opendj-dsml-servlet (4.5.7), org.openidentityplatform.opendj:opendj-embedded-server-examples (4.5.7) +3 more potentially affected by CVE-2026-46495 via org.openidentityplatform.opendj:opendj-server-legacy (4.5.7)

org.openidentityplatform.opendj:opendj-server-legacy MAVEN version 4.5.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.openidentityplatform.opendj:opendj-server-legacy and may be impacted: - org.openidentityplatform.opendj:opendj-dsml-servlet 4.5...

org.openidentityplatform.opendj:opendj-dsml-servlet (4.5.3), org.openidentityplatform.opendj:opendj-embedded-server-examples (4.5.3) +3 more potentially affected by CVE-2026-46495 via org.openidentityplatform.opendj:opendj-server-legacy (4.5.3)

org.openidentityplatform.opendj:opendj-server-legacy MAVEN version 4.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.openidentityplatform.opendj:opendj-server-legacy and may be impacted: - org.openidentityplatform.opendj:opendj-dsml-servlet 4.5...

org.openidentityplatform.opendj:opendj-dsml-servlet (4.9.0), org.openidentityplatform.opendj:opendj-embedded (4.9.0) +4 more potentially affected by CVE-2026-46495 via org.openidentityplatform.opendj:opendj-server-legacy (4.9.0)

org.openidentityplatform.opendj:opendj-server-legacy MAVEN version 4.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.openidentityplatform.opendj:opendj-server-legacy and may be impacted: - org.openidentityplatform.opendj:opendj-dsml-servlet 4.9...

GHSA-3W66-95M3-8JXG Grafana: Pre-authentication denial of service in the public dashboard query handler

The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access tok...

CVE-2026-42129

A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information...

EUVD-2026-38201

A vulnerability has been found in coollabsio coolify 4.0.0. Impacted is an unknown function of the component Image Name Handler. Such manipulation leads to os command injection. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in an...

EUVD-2026-38204

A security flaw has been discovered in Browserbase up to 20260526. This impacts an unknown function of the component Autobrowse Trace Artifact Handler. The manipulation results in incorrect default permissions. The attack requires a local approach. The exploit has been released to the public and...

EUVD-2026-38199

A vulnerability was detected in activepieces up to 0.83.0. This vulnerability affects the function handleUrlFile in the library packages/server/engine/src/lib/variables/processors/file.ts of the component File URL Handler. The manipulation results in server-side request forgery. The attack can be...

EUVD-2026-38196

A security flaw has been discovered in Edimax BR-6478AC V2 1.23. Affected by this vulnerability is the function mp of the file /goform/mp of the component POST Request Handler. Performing a manipulation of the argument command results in command injection. The attack may be initiated remotely. Th...

CVE-2026-12815

A vulnerability has been found in coollabsio coolify 4.0.0. Impacted is an unknown function of the component Image Name Handler. Such manipulation leads to os command injection. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in an...

CVE-2026-53779: Improper Limitation of a Pathname to a Restricted Directory

WebP Server Go through 0.14.4 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to read files outside the configured IMGPATH directory by sending requests with percent-encoded backslashes %5C that bypass the path.Clean sanitization in handler/router.go...

CVE-2026-12823: Incorrect Default Permissions

A security flaw has been discovered in Browserbase Skills up to 20260526. This impacts an unknown function of the component Autobrowse Trace Artifact Handler. The manipulation results in incorrect default permissions. The attack requires a local approach. The exploit has been released to the publ...

EUVD-2025-210298

GitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder without user approval via a file-handler URI parameter to fetchwebpage. Therefore, exfiltration could occur if there is indirect prompt injection...

CVE-2025-66389: Undefined Security Weakness

GitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder without user approval via a file-handler URI parameter to fetchwebpage. Therefore, exfiltration could occur if there is indirect prompt injection...

CVE-2025-66389

GitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder without user approval via a file-handler URI parameter to fetchwebpage. Therefore, exfiltration could occur if there is indirect prompt injection...

CVE-2026-12815: Improper Neutralization of Special Elements used in an OS Command

A vulnerability has been found in coollabsio coolify 4.0.0. Impacted is an unknown function of the component Image Name Handler. Such manipulation leads to os command injection. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in an...

PT-2026-51297

Name of the Vulnerable Software and Affected Versions GitHub Copilot version 1.372.0 Description An issue exists where the software allows filesystem access outside of a workspace folder without user approval. This occurs via a file-handler URI parameter used in the fetch webpage function. This...

CVE-2026-12823 Browserbase Skills Autobrowse Trace Artifact default permission

A security flaw has been discovered in Browserbase Skills up to 20260526. This impacts an unknown function of the component Autobrowse Trace Artifact Handler. The manipulation results in incorrect default permissions. The attack requires a local approach. The exploit has been released to the publ...