Lucene search
+L

64220 matches found

CVE
CVE
added 5 days ago19 views

CVE-2026-8056

Summary: IBM Langflow OSS 1.0.0–1.10.0 contains a parameter injection vulnerability in the API Graph Execution Engine. A flaw in the parameter filtering logic in the apply_tweaks() function allows authenticated users to override component parameters at runtime via the tweaks API, potentially exec...

8.8CVSS5.3AI score0.00294EPSS
Exploits0References1Affected Software1
EUVD
EUVD
added 5 days ago9 views

EUVD-2026-45276

IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the disk-based caching mechanism. The AsyncDiskCache class uses Python's unsafe pickle.loads function to deserialize cached objects from disk without validation, integrity verification, or...

9.9CVSS6.5AI score0.00483EPSS
Exploits0References1
NVD
NVD
added 5 days ago9 views

CVE-2026-48008

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a non-admin API user with integration:create ACL privilege can escalate to full administrator by creating an integration with admin: true through the Sync API POST /api/action/sync; the regular integration endpoint POST...

6.5CVSS0.00264EPSS
Exploits0References5
NVD
NVD
added 5 days ago7 views

CVE-2026-48009

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a low-privilege admin user with userrecovery:read ACL can take over any admin account by triggering POST /api/action/user/user-recovery, reading the password recovery hash through POST /api/search/user-recovery, and using PAT...

6.8CVSS0.00272EPSS
Exploits0References6
NVD
NVD
added 5 days ago9 views

CVE-2026-49208

Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, when a LiveProp is typed as DateTimeInterface and no explicit format is configured, Symfony\UX\LiveComponent\LiveComponentHydrator::hydrateObjectValue falls back to new $className$value, allowing client-supplied...

6.9CVSS0.0024EPSS
Exploits0References4
NVD
NVD
added 5 days ago7 views

CVE-2026-16106

A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated administrator attempts to remove a child role from a composite role. Due to missing authorization checks, an attacker with limited administrative permissions can...

4.9CVSS0.00201EPSS
Exploits0References2
Vulnrichment
Vulnrichment
added 5 days ago13 views

CVE-2026-16106 Keycloak-services: keycloak-services: incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles

A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated administrator attempts to remove a child role from a composite role. Due to missing authorization checks, an attacker with limited administrative permissions can...

4.9CVSS5.3AI score0.00201EPSS
Exploits0References2
Cvelist
Cvelist
added 5 days ago36 views

CVE-2026-16106 Keycloak-services: keycloak-services: incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles

A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated administrator attempts to remove a child role from a composite role. Due to missing authorization checks, an attacker with limited administrative permissions can...

4.9CVSS0.00201EPSS
Exploits0References2
OSV
OSV
added 5 days ago5 views

CVE-2026-49208 Symfony UX: Format-less date LiveProps parsed with the permissive DateTime constructor

Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, when a LiveProp is typed as DateTimeInterface and no explicit format is configured, Symfony\UX\LiveComponent\LiveComponentHydrator::hydrateObjectValue falls back to new $className$value, allowing client-supplied...

6.9CVSS5.2AI score0.0024EPSS
Exploits0References6
NVD
NVD
added 5 days ago8 views

CVE-2026-51083

Incorrect access control in Proxmox Virtual Environment PVE 9.x qemu-server before 9.1.8 and 8.x before 8.4.8 allows users within limited privileges to obtain hashed passwords via the cloudinit/dump API...

6.5CVSS0.00201EPSS
Exploits0References1
NVD
NVD
added 5 days ago9 views

CVE-2026-51082

A race condition between the vncproxy and vncwebsocket API calls in Proxmox Virtual Environment PVE 9.x pve-manager before 9.1.9 and 8.x before 8.4.19; qemu-server 9.x before 9.1.7 and 8.x before 8.4.7; and pve-container before 6.1.3 PVE 9.x and before 5.3.4 PVE 8.x allows an attacker with...

7.2CVSS0.00221EPSS
Exploits0References1
Veracode
Veracode
added 5 days ago8 views

Improper Enforcement Of Security Policy

github.com/forgekeep/nebula-mesh is vulnerable to Improper Enforcement of Security Policy. The vulnerability is due to the Web UI host-creation endpoint hardcoding a 24-hour enrollment token lifetime instead of enforcing the configured server-wide or per-network enrollment token TTL, which allows...

5.3AI score
Exploits0References2Affected Software1
Ubuntu
Ubuntu
added 5 days ago11 views

USN-8490-2: Linux kernel (Real-time) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - Block layer subsystem; - Cryptographic API; - DMA engine subsystem; - InfiniBand drivers; -...

9.8CVSS6.9AI score0.00817EPSS
Exploits9
OSV
OSV
added 5 days ago5 views

USN-8490-2 linux-realtime, linux-realtime-6.17 vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - Block layer subsystem; - Cryptographic API; - DMA engine subsystem; - InfiniBand drivers; -...

9.8CVSS6.9AI score0.00817EPSS
Exploits9References62
Ubuntu
Ubuntu
added 5 days ago18 views

USN-8490-1: Linux kernel vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - Block layer subsystem; - Cryptographic API; - DMA engine subsystem; - InfiniBand drivers; -...

9.8CVSS6.2AI score0.00817EPSS
Exploits9
EUVD
EUVD
added 5 days ago6 views

EUVD-2026-45155

Improper access control in Hashtopolis server web-interface chunk activity component for versions prior to 0.14.8 allows any created account to read all cracked hashes of a Hashtopolis server instance...

7.1CVSS5.3AI score0.00338EPSS
Exploits0References3
NVD
NVD
added 5 days ago11 views

CVE-2026-62235

Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-next REST API that allows authenticated users with only api.access permission to perform unauthorized CRUD operations on permission-less directories. Attackers with api.access credentials can create...

6.3CVSS0.00169EPSS
Exploits0References2
Cvelist
Cvelist
added 5 days ago36 views

CVE-2026-62235 Grav Flex-Objects < 1.4.3 Authorization Bypass via API

Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-next REST API that allows authenticated users with only api.access permission to perform unauthorized CRUD operations on permission-less directories. Attackers with api.access credentials can create...

6.3CVSS0.00169EPSS
Exploits0References2
EUVD
EUVD
added 5 days ago12 views

EUVD-2026-45081

Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-next REST API that allows authenticated users with only api.access permission to perform unauthorized CRUD operations on permission-less directories. Attackers with api.access credentials can create...

6.3CVSS6.1AI score0.00169EPSS
Exploits0References2
OSV
OSV
added 5 days ago5 views

CVE-2026-62235 Grav Flex-Objects < 1.4.3 Authorization Bypass via API

Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-next REST API that allows authenticated users with only api.access permission to perform unauthorized CRUD operations on permission-less directories. Attackers with api.access credentials can create...

2.3CVSS5.4AI score0.00169EPSS
Exploits0References5
Rows per page
Query Builder