1153826 matches found
JLSEC-2026-795 Hugo: security.http.urls allow-list bypass via HTTP redirects
Commit: 86fbb0f7a8 — security: Validate redirects against security.http.urls Affected versions: v0.91.0 when security.http.urls was introduced through v0.161.1. Fixed in: v0.162.0. Severity: Only relevant for sites that rely on security.http.urls as a trust boundary — e.g. CI builds that fetch...
CVE-2026-54696 vulnerabilities
Vulnerabilities for packages: kube-logging-operator...
CVE-2026-54171 vulnerabilities
Vulnerabilities for packages: kube-logging-operator...
GHSA-48RX-C7PG-Q66R vulnerabilities
Vulnerabilities for packages: kube-logging-operator...
GHSA-X2F5-4PRF-W687 vulnerabilities
Vulnerabilities for packages: kube-logging-operator...
Linux Distros Unpatched Vulnerability : CVE-2026-65904
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DOMPurify through 3.3.3 fails to sanitize DOM elements passed via INPLACE mode when the element originates from a different window/realm e.g., an iframe's...
Linux Distros Unpatched Vulnerability : CVE-2026-56746
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through...
OmniFaces: Forged combined-resource IDs and related output/push boundaries
Forged combined-resource IDs CombinedResourceInfo accepts a path-derived ID without an authenticity check, inflates it without an output limit, converts it to attacker-selected resource identifiers, and retains unique IDs in an unbounded static cache. In bounded tests, 20,754 encoded bytes...
GHSA-FP43-VJ7G-PG92 OmniFaces: Forged combined-resource IDs and related output/push boundaries
Forged combined-resource IDs CombinedResourceInfo accepts a path-derived ID without an authenticity check, inflates it without an output limit, converts it to attacker-selected resource identifiers, and retains unique IDs in an unbounded static cache. In bounded tests, 20,754 encoded bytes...
Security Bulletin: Multiple Vulnerabilities in IBM Operator for PostgreSQL
Summary Multiple vulnerabilities were addressed in IBM Operator for PostgreSQL version v28.4.1. Vulnerability Details CVEID:CVE-2026-39830 DESCRIPTION: A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked...
GHSA-F25V-X6VR-962G Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password
Summary The forced password-change flow, triggered when the stored password is still the default admin, does not verify that the password submitted by the client actually matches the current password. Any non-empty value in pheditorpassword is enough to reach the password-change form, and...
Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password
Summary The forced password-change flow, triggered when the stored password is still the default admin, does not verify that the password submitted by the client actually matches the current password. Any non-empty value in pheditorpassword is enough to reach the password-change form, and...
GHSA-PMPG-2MXQ-6XWR Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete
Summary An end-user injection in Budibase's MongoDB datasource lets any BASIC app user bypass the builder's query-level access controls. Builders scope MongoDB reads per-user with bindings like "email": " currentUser.email " so each app user only sees their own rows. Because the binding is...
Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete
Summary An end-user injection in Budibase's MongoDB datasource lets any BASIC app user bypass the builder's query-level access controls. Builders scope MongoDB reads per-user with bindings like "email": " currentUser.email " so each app user only sees their own rows. Because the binding is...
Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Execution
Summary Budibase's MongoDB query execution endpoint POST /api/v2/queries/:queryId is vulnerable to NoSQL injection through user-supplied query parameters. The enrichContext function interpolates parameter values into JSON query templates using Handlebars with noEscaping: true, then parses the...
GHSA-QW6M-8FW2-2V64 Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Execution
Summary Budibase's MongoDB query execution endpoint POST /api/v2/queries/:queryId is vulnerable to NoSQL injection through user-supplied query parameters. The enrichContext function interpolates parameter values into JSON query templates using Handlebars with noEscaping: true, then parses the...
Open WebUI: Arena task endpoints can bypass underlying model access controls
Summary An authenticated non-admin user with read access to an arena wrapper model can reach a restricted underlying model through task endpoints such as /api/v1/tasks/moa/completions. The normal chat route resolves arena models before the final chat dispatch and therefore re-checks the selected...
GHSA-M3QF-58WF-W979 Open WebUI: Arena task endpoints can bypass underlying model access controls
Summary An authenticated non-admin user with read access to an arena wrapper model can reach a restricted underlying model through task endpoints such as /api/v1/tasks/moa/completions. The normal chat route resolves arena models before the final chat dispatch and therefore re-checks the selected...
