78774 matches found
net/sched: act_api: use RCU with deferred freeing for action lifecycle
...
drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size
...
batman-adv: v: stop OGMv2 on disabled interface
...
Missing Authentication For Critical Function
Backpropagate is vulnerable to Missing Authentication for Critical Function. The vulnerability is due to the Reflex web UI failing to enforce the --auth authentication mechanism despite indicating it is enabled, which allows an attacker who can access the exposed UI port to perform unauthorized...
CVE-2026-6519
A flaw was found in Wireshark. A remote attacker could exploit an infinite loop vulnerability within the MBIM Mobile Broadband Interface Model protocol dissector. This could lead to a denial of service DoS condition, making the application unresponsive. Mitigation To mitigate this issue, avoid...
[SECURITY] Fedora 44 Update: python-postorius-1.3.13-1.fc44
The Postorius Django app provides a web user interface to access GNU Mailman...
[SECURITY] Fedora 43 Update: python-postorius-1.3.13-1.fc43
The Postorius Django app provides a web user interface to access GNU Mailman...
EulerOS 2.0 SP15 : vim (EulerOS-SA-2026-2472)
According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim's glob function on...
EulerOS 2.0 SP15 : vim (EulerOS-SA-2026-2513)
According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim's glob function on...
EUVD-2026-38068
gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host...
CVE-2026-56414 H.VIEW HV-500S6 IP Camera Unrestricted Upload of File with Dangerous Type
A vulnerability exists in H.View IP cameras certificate-related upload interfaces allow authenticated users to store arbitrary file content to fixed, persistent filesystem locations without validating file type, structure, or size. This design omission enables the placement of unexpected or...
CVE-2026-55975
A vulnerability exists in H.View IP cameras that could allow an authenticated user to supply unsanitized XML fields to the device's certificate generation interface, which are incorporated into a backend certificate creation command without proper input validation. This may allow for command...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal via the StorageInterface.parentTraversalGuard function. An attacker can access arbitrary files on the host filesystem by submitting a specially crafted kestra:// URI containing URL-encoded directory traversal...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization in the web UI handlers responsible for managing hosts and networks. An attacker can gain unauthorized access to sensitive information and perform destructive actions across resources owned by other operators by...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization in the web UI handlers responsible for managing hosts and networks. An attacker can gain unauthorized access to sensitive information and perform destructive actions across resources owned by other operators by...
GHSA-C6V2-3FFM-VCMC Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)
Summary The web UI /ui/ does not apply the per-operator CA scoping the JSON API received for GHSA-598g-h2vc-h5vg. Any authenticated non-admin operator for example, one created via self-registration or OIDC can access resources belonging to other operators. Impact A non-admin operator can: - Block...
Debug Messages Revealing Unnecessary Information
Overview @mcptoolshop/backpropagate is a Deprecated npm distribution shim for backpropagate — prints install guidance for pipx/uv tool/pip. See https://github.com/mcp-tool-shop-org/backpropagate Affected versions of this package are vulnerable to Debug Messages Revealing Unnecessary Information i...
GHSA-F65R-H4G3-3H9H Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication
Summary In backpropagate = 1.1.0, the optional Reflex web UI pip install backpropagateui, launched via backprop ui exposes a training control plane: dataset upload, model load, training start/stop, multi-run orchestration, GGUF export, and HuggingFace Hub push. The CLI accepts two operator-facing...
GHSA-47Q9-M4WW-924M vulnerabilities
Vulnerabilities for packages: ratify-fips, falcoctl-fips, tflint, tekton-chains, kubescape-server, kubescape-server-fips, slsa-verifier, gitsign, kyverno-fips, neuvector-sigstore-interface-fips, crossplane-fips, aactl, tekton-chains-fips, ko-fips, zarf, kyverno, policy-controller, ratify,...
CVE-2026-48702 vulnerabilities
Vulnerabilities for packages: ratify-fips, falcoctl-fips, tflint, tekton-chains, kubescape-server, kubescape-server-fips, slsa-verifier, gitsign, kyverno-fips, neuvector-sigstore-interface-fips, crossplane-fips, aactl, tekton-chains-fips, ko-fips, zarf, kyverno, policy-controller, ratify,...