72713 matches found
EUVD-2026-4492
gemini-mcp-tool vulnerable to OS command injection and @file exfiltration via prompt quoting CVE-2026-0755...
CGA-8PF8-RM6H-Q3QM
Bulletin has no description...
ECHO-3E02-3A01-4AE3
Bulletin has no description...
GHSA-2JQ4-Q6VV-4CP3
creationtimestamp| type| source ---|---|--- 2026-06-18 19:11:23+00:00| seen| https://gist.github.com/alon710/2a767af5c208a82e89707e10b62dcf61 2026-06-18 19:21:43+00:00| seen| https://gist.github.com/alon710/2aa5fa13eea204ffabb0321701e9195f...
GHSA-R253-R9JW-QG44
creationtimestamp| type| source ---|---|--- 2026-06-18 18:41:53+00:00| seen| https://gist.github.com/alon710/41babc051db96b1507f3fb804d7012be 2026-06-18 18:51:38+00:00| seen| https://gist.github.com/alon710/3807d480d537cf9538209dc130bd58ae 2026-06-18 19:02:49+00:00| seen|...
CVE-2025-32437
creationtimestamp| type| source ---|---|--- 2026-06-18 18:36:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3molhuccpkl2s...
CVE-2026-46580
creationtimestamp| type| source ---|---|--- 2026-06-18 17:23:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moldrmjype2w...
Daytona: Path traversal in sandbox volume id mounts arbitrary host paths into the sandbox — cross-tenant data access and host escape
Summary A sandbox volume reference volumeId, which may also be a volume name was forwarded to the runner and used to build the host bind-mount source path without confinement. A reference containing path-traversal sequences could in principle resolve the mount source outside the intended per-volu...
GHSA-FJV8-J4P5-CR9M Daytona: Path traversal in sandbox volume id mounts arbitrary host paths into the sandbox — cross-tenant data access and host escape
Summary A sandbox volume reference volumeId, which may also be a volume name was forwarded to the runner and used to build the host bind-mount source path without confinement. A reference containing path-traversal sequences could in principle resolve the mount source outside the intended per-volu...
CVE-2026-54104
The U.S. Government Accountability Office GAO Electronic Protest Docketing System EPDS and Civilian Board of Contract Appeals CBCA Electronic Docketing System EDS trusts client-provided values for the 'epdsroleid' parameter without verification, allowing a remote, authenticated attacker to escala...
CVE-2026-12565
creationtimestamp| type| source ---|---|--- 2026-06-18 17:11:50+00:00| seen| https://gist.github.com/alon710/8812bad8b22fe18c159a9af87742e425...
CVE-2026-12566
creationtimestamp| type| source ---|---|--- 2026-06-18 16:41:21+00:00| seen| https://gist.github.com/alon710/d4f4b73b0a184d9eef118aa0970357bf...
EUVD-2026-37912
The U.S. Government Accountability Office GAO Electronic Protest Docketing System EPDS and Civilian Board of Contract Appeals CBCA Electronic Docketing System EDS expose sensitive account information through the 'update-profile/' API endpoint. A remote, unauthenticated attacker can submit a reque...
CVE-2026-54105
The CVE concerns CVE-2026-54105 affecting the GAO EPDS and CBCA EDS systems. The vulnerability arises from the update-profile/ API endpoint, where a remote, unauthenticated attacker can supply an arbitrary user_id and receive a JSON response containing account-specific information, including the ...
CVE-2026-54104
The CVE-2026-54104 entry covers a privilege escalation flaw in the U.S. GAO EPDS and CBCA EDS client authentication flow. The systems trust client-provided values for the epds_role_id parameter without verification, enabling a remote, authenticated attacker to raise their privileges. Affected com...
User Impersonation
Overview Affected versions of this package are vulnerable to User Impersonation via the agentid metadata in the gRPC communication process. An attacker can impersonate other agents on the same server by injecting a forged value into outgoing metadata, leading to unauthorized cross-tenant actions...
ECHO-1E6E-2E1A-3941
Bulletin has no description...
ECHO-9581-AFF6-F7DB
Bulletin has no description...