30499 matches found
CVE-2026-73635
A flaw was found in Apache Struts. An unauthenticated remote client can exploit a vulnerability where the framework's localized-text caches grow without bound. This occurs when no fixed locale is configured, and the locale for text lookups is derived from the incoming request. This can lead to th...
CVE-2026-85603
Grav versions before 1.10.55 contain a path traversal vulnerability in the admin plugin's Save As action that fails to validate the language code parameter. An authenticated admin user with admin.pages.create permission can supply directory traversal sequences in the lang POST field to write...
EUVD-2026-71026
Grav versions before 1.10.55 contain a path traversal vulnerability in the admin plugin's Save As action that fails to validate the language code parameter. An authenticated admin user with admin.pages.create permission can supply directory traversal sequences in the lang POST field to write...
CVE-2026-85603 Grav Admin Plugin Path Traversal via Save As Language Code
Grav versions before 1.10.55 contain a path traversal vulnerability in the admin plugin's Save As action that fails to validate the language code parameter. An authenticated admin user with admin.pages.create permission can supply directory traversal sequences in the lang POST field to write...
CVE-2026-85603 Grav Admin Plugin Path Traversal via Save As Language Code
Grav versions before 1.10.55 contain a path traversal vulnerability in the admin plugin's Save As action that fails to validate the language code parameter. An authenticated admin user with admin.pages.create permission can supply directory traversal sequences in the lang POST field to write...
CVE-2026-85603
Grav versions before 1.10.55 contain a path traversal vulnerability in the admin plugin's Save As action. The root cause is a missing validation of the language code (lang) POST field, allowing an authenticated user with the admin.pages.create permission to inject directory traversal sequences. T...
Security update for podman
This update for podman rebuilds it against the current go security release. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the command listed for your product: SUSE Linux Enterprise...
sshroute v0.2.12
sshroute CI | Code | OpenSpec | Security ---|---|---|--- | | |...
CVE-2026-78662 vulnerabilities
Vulnerabilities for packages: telegraf, pulumi-kubernetes-operator, scorecard, rootlesskit-fips, mediamtx, frankenphp-8.5, kubernetes, crossplane-cli-fips, commercial-expanso-edge, grype-fips, opentelemetry-collector, zot, docker-cli-buildx, gitlab-runner, grafana, opentofu, omnictl-multiarch-fip...
GO-2026-6355 vulnerabilities
Vulnerabilities for packages: telegraf, pulumi-kubernetes-operator, scorecard, rootlesskit-fips, mediamtx, frankenphp-8.5, kubernetes, crossplane-cli-fips, commercial-expanso-edge, grype-fips, opentelemetry-collector, zot, docker-cli-buildx, gitlab-runner, grafana, opentofu, omnictl-multiarch-fip...
GO-2026-6354 vulnerabilities
Vulnerabilities for packages: telegraf, pulumi-kubernetes-operator, scorecard, rootlesskit-fips, mediamtx, frankenphp-8.5, kubernetes, crossplane-cli-fips, commercial-expanso-edge, grype-fips, opentelemetry-collector, zot, docker-cli-buildx, gitlab-runner, grafana, opentofu, omnictl-multiarch-fip...
CVE-2026-56855 vulnerabilities
Vulnerabilities for packages: pulumi-language-java, gatus, grafana-alloy, argo-events, gitness, kots, sftpgo, gomplate, rclone, skaffold, k3s, rancher-fleet, opentelemetry-collector, gptscript, nfpm, external-dns, trufflehog, pulumi-kubernetes-operator, tfsec, zarf, nerdctl, act, kubevela, nuclei...
GO-2026-6354 vulnerabilities
Vulnerabilities for packages: pulumi-language-java, gatus, grafana-alloy, argo-events, gitness, kots, sftpgo, gomplate, rclone, skaffold, k3s, rancher-fleet, opentelemetry-collector, gptscript, nfpm, external-dns, trufflehog, pulumi-kubernetes-operator, tfsec, zarf, nerdctl, act, kubevela, nuclei...
CVE-2026-78662 vulnerabilities
Vulnerabilities for packages: pulumi-language-java, gatus, grafana-alloy, argo-events, gitness, kots, sftpgo, gomplate, rclone, skaffold, k3s, rancher-fleet, opentelemetry-collector, gptscript, nfpm, external-dns, trufflehog, pulumi-kubernetes-operator, tfsec, zarf, nerdctl, act, kubevela, nuclei...
GO-2026-6355 vulnerabilities
Vulnerabilities for packages: pulumi-language-java, gatus, grafana-alloy, argo-events, gitness, kots, sftpgo, gomplate, rclone, skaffold, k3s, rancher-fleet, opentelemetry-collector, gptscript, nfpm, external-dns, trufflehog, pulumi-kubernetes-operator, tfsec, zarf, nerdctl, act, kubevela, nuclei...
EUVD-2026-70793
Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network...
PT-2026-85503
Name of the Vulnerable Software and Affected Versions Grav versions prior to 1.10.55 Description A path traversal issue exists in the admin plugin's Save As action due to improper validation of the language code parameter. An authenticated admin user with admin.pages.create permission can use...
CVE-2026-75170: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the /loginController/doLogin endpoint of the HubCore platform version 14.1.1 allows a remote unauthenticated attacker to inject arbitrary JavaScript into the application's response via the language POST parameter...
PT-2026-85699
CVE-2026-75170: Unauthenticated XSS in HubCore 14.1.1 via /loginController/doLogin language param. CVSS N/A, no patch yet. Attackers can inject arbitrary JS. Audit exposure and restrict access now. Details: https://t.co/2JPeD1RjLr CVE infosec XSS valtersit snippet infosec SysAdmin cybersecurity...
CVE-2026-75170
Cross-site scripting XSS vulnerability in the /loginController/doLogin endpoint of the HubCore platform version 14.1.1 allows a remote unauthenticated attacker to inject arbitrary JavaScript into the application's response via the language POST parameter...