7402 matches found
EUVD-2026-60114
opensslencrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute malicious plugins with unrestricted access to the filesystem, network, subprocess execution, and all Python modules...
CVE-2026-74895
openssl_encrypt (Python package) versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution, allowing attackers to run malicious plugins with unrestricted filesystem, network, subprocess, and Python module access (CVSS 9.8 CRITICAL). No in-...
CVE-2026-74895 openssl_encrypt before 1.4.0 Plugin Sandbox Bypass via Process Isolation
opensslencrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute malicious plugins with unrestricted access to the filesystem, network, subprocess execution, and all Python modules...
CVE-2026-74895 openssl_encrypt before 1.4.0 Plugin Sandbox Bypass via Process Isolation
opensslencrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute malicious plugins with unrestricted access to the filesystem, network, subprocess execution, and all Python modules...
CVE-2026-74878 openssl_encrypt before 1.4.0 TOTP Rate Limiter Bypass
opensslencrypt versions before 1.4.0 use an in-memory rate limiter for TOTP brute-force protection that is not shared across workers and is lost on server restart. Attackers can distribute authentication attempts across multiple server instances or retry immediately after a restart to bypass rate...
BIT-CONSUL-2026-16326 consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability CVE-2026-16326 is fixed in consul-mcp-server 0.1.4...
No title provided
A flaw was found in AMD Zen 2-based processors, affecting components such as the kernel and Xen hypervisor. Improper isolation of shared resources within the CPU operation cache could allow an attacker to corrupt instructions executed at a different privilege level. This could potentially result ...
CVE-2026-18674: Insufficient Verification of Data Authenticity
On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store...
Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: firefox (UTSA-2026-101099)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101099 advisory. Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. Tenable h...
Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-100896)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100896 advisory. A process isolation vulnerability in Thunderbird stemmed from improper handling of javascript: URIs, which could allow content to execute in the top-level document's...
Sandboxie v1.18.2
Sandboxie Plus / Classic EN | δΈζ System requirements| Release notes| Contribution guidelines| Security policy| Code of Conduct ---|---|---|---|--- Windows 7 or higher 64-bit| CHANGELOG.md| CONTRIBUTING.md| SECURITY.md| CODEOFCONDUCT.md Sandboxie is a sandbox-based isolation software for Windows...
CVE-2026-74790 Scriban before 7.0.0 MemberFilter Bypass via TemplateContext Cache
Scriban before 7.0.0 caches TypedObjectAccessor by Type only without considering MemberFilter changes, allowing reused TemplateContext instances to expose members that should be hidden. Attackers can access filtered properties and fields by reusing a TemplateContext after tightening its...
CVE-2026-73632
Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the...
CVE-2026-72235
In the Linux kernel, the following vulnerability has been resolved: batman-adv: retrieve ethhdr after potential skb realloc on RX pskbmaypull in batadvinterfacerx could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an...
CVE-2026-72055
In the Linux kernel, the following vulnerability has been resolved: net: ip6vti: require CAPNETADMIN in the device netns for changelink vti6changelink operates on at most two netns, devnetdev and the tunnel link netns t-net. They differ once the device is created in or moved to a netns other than...
EUVD-2026-59134
In the Linux kernel, the following vulnerability has been resolved: batman-adv: retrieve ethhdr after potential skb realloc on RX pskbmaypull in batadvinterfacerx could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an...
CVE-2026-72045 octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF rvumboxhandlerlmtsttblsetup uses req-basepcifunc as a direct index into the LMT map table to read another function's LMTLINE physical base address and copy it into th...
vm2 v3.11.6
vm2 vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Important Security Disclaimer Before using vm2, you should understand how it works and its limitations. vm2 attempts to sandbox untrusted JavaScript code within the same Node.js process as your application...
CVE-2026-72837
File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope...
CVE-2026-72837 File Browser before 2.63.20 Privilege Escalation via Proxy Authentication
File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope...