CVE-2026-79678

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate an...

UBUNTU-CVE-2026-79678

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate an...

CVE-2026-79678

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate an...

CVE-2026-79678

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate an...

Linux Distros Unpatched Vulnerability : CVE-2026-18712

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause...

ROS-20260907-73-0084

The vulnerability of UEFI microprogramming systems of Intel processors is related to insufficient validation of input data. Exploiting this vulnerability can allow attackers to enhance their privileges...

ROS-20260907-73-0018

The vulnerability in the buildkit is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to cause service failures...

CVE-2026-86174 Plane through 1.4.2 Arbitrary Comment Write via Public Deploy Board

Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comments to arbitrary issues across workspaces by supplying an issueid parameter to the public deploy-board comment endpoint...

CVE-2026-64195 Out Of Bounds Write parsing a .DSB file in DASYLab due to lack of proper validation of user-supplied data

There is an out-of-bounds write vulnerability in DASYLab due to lack of proper validation of user-supplied data. Successful exploitation requires an attacker to get a user to open a specially crafted .DSB file. This issue affects all versions before 2026.0.0...

CVE-2026-64195

CVE-2026-64195 is an out-of-bounds write vulnerability in DASYLab (by MEAS X), caused by insufficient validation of user-supplied data when parsing a .DSB file . Successful exploitation requires a user to open a specially crafted .DSB file. All versions before 2026.0.0 are affected; updating to 2...

CVE-2026-85166

n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow e.g., the Workflow Tool node. A shared-workflow editor, or any user creating/updating a workflow via the REST API, Public API, or MCP, can...

CVE-2026-20355

Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions S/MIME decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities are due to insufficient validation of messa...

CVE-2026-18672

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadImageEditor may allow an attacker to influence which file is returned by the control's image cache, potentially exposing file contents outside the intended image directories...

EUVD-2026-69897

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadImageEditor may allow an attacker to influence which file is returned by the control's image cache, potentially exposing file contents outside the intended image directories...

PT-2026-84592

The WP File Download plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete function in all versions. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server,...

The vulnerability in the Accessibility component of Google Chrome and Microsoft Edge browsers allows attackers to gain access to confidential data and compromise its integrity.

The vulnerability of the Accessibility component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data and compromise its integrity through a specially created HTML pag...

The vulnerability of the validate_network_url() function in the NLTK library for symbolic and statistical processing allows a attacker to perform an SSRF attack.

The vulnerability of the validatenetworkurl function in the NLTK library for symbolic and statistical processing related to insufficient validation of requests on the server side. Exploiting this vulnerability could allow a malicious actor to perform an SSRF attack remotely...

The vulnerability of the Media component in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.

The vulnerability of the Media component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure using a specially created video file...

PT-2026-84661

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadImageEditor may allow an attacker to influence which file is returned by the control's image cache, potentially exposing file contents outside the intended image directories...

The vulnerability of the WebUI components in Google Chrome and Microsoft Edge browsers allows attackers to access confidential data.

The vulnerability of the WebUI components in Google Chrome and Microsoft Edge relates to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain access to confidential data remotely...