15699 matches found
CVE-2026-14670
A flaw was found in PostgreSQL. A heap buffer overflow vulnerability exists in the plperl component when returning a tied hash. This allows a function owner to execute arbitrary code as the operating system user running the database by providing a specially crafted function body. This could lead ...
PT-2026-84018
Name of the Vulnerable Software and Affected Versions Hash Form versions 1.4.2 and earlier Description An unauthenticated arbitrary file upload issue exists, allowing an attacker to upload files, such as a web shell, without requiring authentication. Recommendations Update Hash Form to a version...
CVE-2026-81780: Unrestricted Upload of File with Dangerous Type
Unauthenticated Arbitrary File Upload in Hash Form = 1.4.2 versions...
CVE-2026-82634
Frappe Framework development builds contain an authorization flaw in the renderjinjatemplate endpoint that allows low-privileged users to render arbitrary Jinja templates by supplying raw template strings. Attackers with print permission on any document can execute arbitrary SELECT statements...
CVE-2026-82634
Frappe Framework development builds contain an authorization flaw in the render_jinja_template endpoint (file: print_format_generator.py). Low-privileged users with print permission on any document can supply raw Jinja template strings, enabling arbitrary SELECT statements against unrelated table...
CVE-2026-82634 Frappe Framework Development Branch Incorrect Authorization via Jinja Template Preview Endpoint
Frappe Framework development builds contain an authorization flaw in the renderjinjatemplate endpoint that allows low-privileged users to render arbitrary Jinja templates by supplying raw template strings. Attackers with print permission on any document can execute arbitrary SELECT statements...
PT-2026-83554
Frappe Framework development builds contain an authorization flaw in the render jinja template endpoint that allows low-privileged users to render arbitrary Jinja templates by supplying raw template strings. Attackers with print permission on any document can execute arbitrary SELECT statements...
SUSE CVE-2026-40017
An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU disproportionate to the size of the message. This is a separate issue from CVE-2026-40014 and is not addressed by that...
Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001393)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001393 advisory. In the Linux kernel, the following vulnerability has been resolved: sched: schcake: fix bulk flow accounting logic for host fairness In schcake, we keep track of the...
Unity Linux 20.1070e Security Update: unbound (UTSA-2026-035854)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-035854 advisory. NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where the code path to consult the negative cache for DS records do...
Linux Distros Unpatched Vulnerability : CVE-2026-40017
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD...
MAL-2026-15529 Malicious code in bui-react-10themes (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a333445d0f8345bc824161bcc7f6487a59ba9f1f7a852da2643eb7c27dd849b package.json declares a dependency whose key equals this package's own name bui-react-10themes and whose value is a bare HTTPS URL...
Malicious code in amplitude-react-native (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 489592652dd724254e29c10536019e0e03e8032e781748a73fc357bb40f50a1d package.json declares a single dependency whose source is a bare HTTPS URL https://repo.securityctrl.com/amplitude-react-native rather than a registr...
MAL-2026-15518 Malicious code in payments-ui-services (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4b49e2f4d16837b49ca7d82e2c5a46c2a861c3f2c3d63596c730749dfec0337 package.json line 11 declares a dependency whose source is the arbitrary HTTPS URL https://repo.securityctrl.com/payments-ui-services instead of a...
CVE-2026-55425
Graylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the System Catalog entity titles endpoint in graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java allows an authenticated user to request...
EUVD-2026-42696
Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes...
Graylog Server: System Catalog titles endpoint can be used to retrieve values of protected database fields
Impact A vulnerability was found in Graylog's API endpoint for retrieving system catalog entity titles. Authenticated users could retrieve database fields of supported entities by sending a custom API request. These fields can include e.g. the password hash of a user but not the password itself,...
GHSA-Q79R-R9XG-R863 Graylog Server: System Catalog titles endpoint can be used to retrieve values of protected database fields
Impact A vulnerability was found in Graylog's API endpoint for retrieving system catalog entity titles. Authenticated users could retrieve database fields of supported entities by sending a custom API request. These fields can include e.g. the password hash of a user but not the password itself,...
Information Exposure
Overview org.graylog2:graylog2-server is a log management platform. Affected versions of this package are vulnerable to Information Exposure in the system catalog entity titles API endpoint, which returns requested database fields without filtering out ones marked protected. A user with a standar...
CVE-2026-55425 Graylog: System Catalog titles endpoint can be used to retrieve values of protected database fields
Graylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the System Catalog entity titles endpoint in graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java allows an authenticated user to request...