315627 matches found
PT-2026-76706
In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log...
CVE-2026-67918
Directory Traversal vulnerability in hermes-studio v.0.6.26 allows a remote attacker to obtain sensitive information via the validatePath function in api/hermes/download endpoint...
PT-2026-76606
Name of the Vulnerable Software and Affected Versions openssl encrypt pip versions prior to 1.4.8 Description An information exposure issue exists where the diagnostic commands 'hsm fido2-test' and 'hsm onlykey-test' unconditionally print the full derived hardware pepper as hex to stdout/stderr v...
PT-2026-76686
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap passes attacker-controlled sourceMappingURL values to joindirnameopts.from, annotation, and loadFile permits traversed ...
Important: firefox
Issue Overview: Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13. CVE-2026-16349 Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 153, Firef...
Important: firefox
Issue Overview: Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13. CVE-2026-16349 Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 153, Firef...
PT-2026-76751
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse...
PT-2026-76829
Name of the Vulnerable Software and Affected Versions Grafana affected versions not specified Description In deployments configured with multiple organizations, an Org Admin of a single organization can access permission data from other organizations. This occurs when calling the 'GET...
CVE-2026-50776
A Directory Traversal vulnerability in Pronis Loisirs Bilttorie CSE (versions before April 2026) allows an unauthenticated remote attacker to read sensitive files and execute arbitrary code. CVSS 3.1 scores it 7.5 (HIGH) with network attack vector, low complexity, and high confidentiality impact....
The vulnerabilities of the functions IndexFile.checkout() and TagReference.create() in the GitPython library for interacting with git repositories allow a malicious individual to gain unauthorized access to protected information.
The vulnerability of the functions IndexFile.checkout and TagReference.create in the GitPython library for interacting with git repositories is related to an incorrect path name limitation when processing the kwargs parameter. Exploiting this vulnerability could allow a malicious actor to gain...
The vulnerability of the Apache Tomcat application server, related to deficiencies in authentication procedures, allows attackers to gain unauthorized access to protected information.
The vulnerability of the Apache Tomcat application server is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...
The vulnerability in the driver/block/rnbd/rnbd-srv.c component of the Linux operating system allows a hacker to gain access to confidential data.
The vulnerability of the drivers/block/rnbd/rnbd-srv.c component in the Linux operating system’s kernel is related to the use of an uninitialized resource. Exploiting this vulnerability could allow a remote attacker to gain access to confidential data...
The vulnerability of the nvme_pr_read_keys() function in the drivers/nvme/host/pr.c kernel of the Linux operating system allows a hacker to disclose sensitive information or cause service failures.
The vulnerability of the nvmeprreadkeys function in the drivers/nvme/host/pr.c module of the Linux operating system is related to unlimited distribution of resources. Exploiting this vulnerability can allow an attacker to disclose sensitive information or cause service failures...
Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099966)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099966 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: xtables: avoid leaking percpu counter pointers The native and compat get-entries paths...
Unity Linux 20.1070e Security Update: rubygem-excon (UTSA-2026-099493)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099493 advisory. Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following...
PT-2026-73181
A vulnerability was identified in CodeCanyon TimeCamp Integration for CRM up to 2.8. This issue affects some unknown processing of the file /clients/save contact of the component Contact Information Update. Such manipulation of the argument contact id leads to authorization bypass. The attack can...
CVE-2026-50776
Directory Traversal vulnerability in Pronis Loisirs Billetterie CSE - 04/2026 allows a remote attacker to obtain sensitive information and execute arbitrary code...
PT-2026-76837
An information leakage was addressed with additional validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10. An app may be able to leak sensitive kernel state...
PT-2026-76680
Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.6 Discourse versions prior to 2026.5.2 Discourse versions prior to 2026.6.1 Discourse versions prior to 2026.7.0 Description Hidden or unviewable first-post content is leaked as an excerpt within the...
PT-2026-76643
Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.6.18 Roundcube Webmail versions 1.7.x prior to 1.7.3 Description An unclosed url in a FuncIRI attribute of an SVG image allows the evasion of remote image blocking. This flaw could potentially lead to...