4446 matches found
CVE-2026-17097: Improper Validation of Array Index
IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the PowerVM hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor call causin...
CVE-2026-71573
Joomla! Core - 20260802 - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper implementation prevented configured CORS origins from being properly validated in CORS requests...
EUVD-2026-61034
Joomla! Core - 20260802 - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper implementation prevented configured CORS origins from being properly validated in CORS requests...
CVE-2026-71573
Joomla! Core is affected by an improper CORS origin validation flaw in versions 4.0.0–5.4.7 and 6.0.0–6.1.2 . An improper implementation prevented configured CORS origins from being properly validated in CORS requests, potentially allowing an attacker to bypass cross-origin restrictions. The NVD ...
CVE-2026-59781
The Zabbix Agent on Windows is vulnerable to DLL sideloading because the installer fails to verify if a custom installation directory has secure access permissions. An attacker could exploit this by placing a malicious DLL in a directory with insecure permissions, which the application might subs...
SUSE-SU-2026:23210-1 Security update for patch
This update for patch fixes the following issues - CVE-2021-45261: Invalid Pointer via anotherhunk function bsc1194037. - CVE-2026-56288: crafted unified-diff patch file can cause null pointer derefence bsc1271167. - CVE-2026-56289: improper validation of hunk line offsets can lead to denial of...
CVE-2026-60820: Improper Validation of Specified Quantity in Input
Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM component: REST. Supported versions that are affected are 17.0-26.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration. Successful attacks of...
PT-2026-77192
Name of the Vulnerable Software and Affected Versions Joomla! Core versions 4.0.0 through 5.4.7 Joomla! Core versions 6.0.0 through 6.1.2 Description An improper implementation of Cross-Origin Resource Sharing CORS prevents configured origins from being properly validated during CORS requests. CO...
CVE-2026-75625: Improper Validation of Integrity Check Value
Kraken agents fail to verify peer-to-peer downloaded blobs against their requested SHA-256 digest before committing to the content-addressable cache, relying only on CRC32 checksums for piece validation. Attackers on the agent-to-agent path or malicious peers can supply substituted content with...
EUVD-2026-60371
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could have allowed an unauthenticated user to execute mutations via GET requests due to improper request...
CVE-2026-19650
In GitLab CE/EE, improper request validation in GraphQL multiplex query handling allowed an unauthenticated user to execute mutations via GET requests. Affected versions are 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4. CVSS 3.1 scores 7.1 (HIGH), with high...
CVE-2026-19650
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could have allowed an unauthenticated user to execute mutations via GET requests due to improper request...
EUVD-2026-60196
In Progress ShareFile Storage Zones Controller versions = 5.12.5 and = 6.0.2, an authenticated zone administrator can exploit improper validation in the download preparation flow, enabling attacker-controlled files to be written outside the intended preparation directory. This can lead to remote...
BIT-MONGODB-2026-13062 MongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Commands on Sharded Clusters
An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a sharded cluster. This can result in...
BIT-MONGODB-2026-13059 Improper Validation of Client-Supplied Command Parameters Allowing Role-Based Access Control Bypass
An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and aggregate commands ...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099465)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099465 advisory. Improper validation of type oidvector in PostgreSQL allows a database user to disclose a few bytes of server memory. We have not ruled out viability of attacks that...
PT-2026-73291
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to modify CI/CD configuration belonging to another user due to improper validation of...
PT-2026-76769
Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.2 through 18.11.10 GitLab CE/EE versions 19.0 through 19.0.7 GitLab CE/EE versions 19.1 through 19.1.5 GitLab CE/EE versions 19.2 through 19.2.3 Description Improper request validation in GraphQL multiplex query handli...
Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-100888)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100888 advisory. Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker to create a punycode hostname that one part of a syste...