75385 matches found
CVE-2026-84702 facefusion before 3.7.0 Path Traversal via Job Identifier
facefusion through 3.6.1 fails to normalize job identifiers in getjobfilename, allowing attackers to write files outside the jobs directory. Attackers can supply traversal sequences in the job identifier parameter through the unauthenticated HTTP API to create files at arbitrary locations...
CVE-2026-84702
facefusion through 3.6.1 is vulnerable to a path traversal flaw in the get_job_file_name function (located in facefusion/jobs/job_manager.py), which fails to normalize job identifiers. An attacker can supply traversal sequences in the job identifier parameter via the unauthenticated HTTP API to w...
EUVD-2026-69793
facefusion through 3.6.1 fails to normalize job identifiers in getjobfilename, allowing attackers to write files outside the jobs directory. Attackers can supply traversal sequences in the job identifier parameter through the unauthenticated HTTP API to create files at arbitrary locations...
CVE-2026-84702 facefusion before 3.7.0 Path Traversal via Job Identifier
facefusion through 3.6.1 fails to normalize job identifiers in getjobfilename, allowing attackers to write files outside the jobs directory. Attackers can supply traversal sequences in the job identifier parameter through the unauthenticated HTTP API to create files at arbitrary locations...
PT-2026-84605
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token before running the post-booking action chain, allowing an unauthenticated user to trigger booking notifications and integration callbacks for a booking by...
CVE-2026-78584: Observable Response Discrepancy
Observable Response Discrepancy CWE-204 in the Kibana Osquery feature can lead to information disclosure via Query System for Information CAPEC-54. An authenticated user holding Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are no...
PT-2026-84606
The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users' reservations. This is an...
PT-2026-84581
facefusion through 3.6.1 fails to normalize job identifiers in get job file name, allowing attackers to write files outside the jobs directory. Attackers can supply traversal sequences in the job identifier parameter through the unauthenticated HTTP API to create files at arbitrary locations...
GHSA-VCC3-GHJQ-M6FR vulnerabilities
Vulnerabilities for packages: wazuh-dashboard, kubeflow-pipelines, vitess, dotstatsuite-supercore, commercial-gitlab-rails-ee-fips, kibana, nextcloud-server, wazuh-dashboard-fips, opensearch-dashboards-fips, gitlab-rails-ce-fips, gitlab-rails-ce, commercial-gitlab-rails-ee, sqlpad,...
CGA-8VMV-G55Q-X9G7
Bulletin has no description...
CLEANSTART-2026-RU71621 Security fixes in grafana 12.4.7-r1
Package grafana version 12.4.7-r1 fixes 10 vulnerabilities: ghsa-r277-6w6q-xmqw, ghsa-jpcw-4wr7-c3vq, ghsa-gcjh-h69q-9w9g, CVE-2026-21728, CVE-2026-28377...
CLEANSTART-2026-JJ72716 Security fixes in kubernetes-event-exporter 1.6.1-r1
Package kubernetes-event-exporter version 1.6.1-r1 fixes 1 vulnerabilities: ghsa-hrxh-6v49-42gf...
CVE-2026-81523
A flaw was found in libmongocrypt. A missing input validation vulnerability in the automatic-encryption context setup allows a caller-supplied database identifier to be accepted without proper sanitization. This can lead to incorrect schema selection, potentially resulting in limited disclosure o...
CGA-8GMJ-85G4-HV76
Bulletin has no description...
MINI-V4W6-R46G-FCR3
Bulletin has no description...
CGA-3R3Q-32PX-J86Q
Bulletin has no description...
MINI-6QRX-RRG8-86FC
Bulletin has no description...
MINI-52JM-42FP-V64P
Bulletin has no description...