4353 matches found
PT-2026-77192
Name of the Vulnerable Software and Affected Versions Joomla! Core versions 4.0.0 through 5.4.7 Joomla! Core versions 6.0.0 through 6.1.2 Description An improper implementation of Cross-Origin Resource Sharing CORS prevents configured origins from being properly validated during CORS requests. CO...
CVE-2026-75625: Improper Validation of Integrity Check Value
Kraken agents fail to verify peer-to-peer downloaded blobs against their requested SHA-256 digest before committing to the content-addressable cache, relying only on CRC32 checksums for piece validation. Attackers on the agent-to-agent path or malicious peers can supply substituted content with...
CVE-2026-19650
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could have allowed an unauthenticated user to execute mutations via GET requests due to improper request...
CVE-2026-19650
In GitLab CE/EE, improper request validation in GraphQL multiplex query handling allowed an unauthenticated user to execute mutations via GET requests. Affected versions are 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4. CVSS 3.1 scores 7.1 (HIGH), with high...
EUVD-2026-60371
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could have allowed an unauthenticated user to execute mutations via GET requests due to improper request...
EUVD-2026-60196
In Progress ShareFile Storage Zones Controller versions = 5.12.5 and = 6.0.2, an authenticated zone administrator can exploit improper validation in the download preparation flow, enabling attacker-controlled files to be written outside the intended preparation directory. This can lead to remote...
BIT-MONGODB-2026-13062 MongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Commands on Sharded Clusters
An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a sharded cluster. This can result in...
BIT-MONGODB-2026-13059 Improper Validation of Client-Supplied Command Parameters Allowing Role-Based Access Control Bypass
An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and aggregate commands ...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099465)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099465 advisory. Improper validation of type oidvector in PostgreSQL allows a database user to disclose a few bytes of server memory. We have not ruled out viability of attacks that...
PT-2026-73291
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to modify CI/CD configuration belonging to another user due to improper validation of...
PT-2026-76769
Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.2 through 18.11.10 GitLab CE/EE versions 19.0 through 19.0.7 GitLab CE/EE versions 19.1 through 19.1.5 GitLab CE/EE versions 19.2 through 19.2.3 Description Improper request validation in GraphQL multiplex query handli...
Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-100888)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100888 advisory. Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker to create a punycode hostname that one part of a syste...
CVE-2026-17173
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of file paths...
CVE-2026-17173
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of file paths...
Improper Validation Of User-Controlled Retry Header Value
Spring Kafka is vulnerable to improper validation of user-controlled retry header value. The vulnerability is due to insufficient validation of the retrytopic-attempts header, which allows an attacker to craft an out-of-range retry attempt count and cause the retry topic router to incorrectly...
PT-2026-72096
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of file paths...
EUVD-2026-58453
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information and perform unauthorized operations due to improper validation of authentication tokens...
CVE-2026-17075
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information and perform unauthorized operations due to improper validation of authentication tokens...