80700 matches found
Linux IIO ADC mt6358_read_imp() Unprotected Information Disclosure
The vulnerability of the mt6358readimp function in the drivers/iio/adc/mt6359-auxadc.c file of various types of built-in sensors in the Linux operating system is related to the use of an uninitialized variable. Exploiting this vulnerability could allow an attacker to gain unauthorized access to...
PT-2026-89168
Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.7.0 through 0.11.0 Description The built-in knowledge search tool fails to properly restrict access to knowledge bases when using specific vector backends. While the tool identifies which knowledge bases a user is permitt...
SUSE CVE-2026-80794
In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix uninit-value in the RF discover/activated NTF handlers ncirfdiscoverntfpacket and ncirfintfactivatedntfpacket each parse a notification into an on-stack struct ncirfdiscoverntf / ncirfintfactivatedntf that is not...
CVE-2026-81192
OpenTelemetry.Resources.Host NuGet package, which provides OpenTelemetry resource detectors for host, is affected by an untrusted search path vulnerability on macOS. Prior to version 1.16.0-beta.2, the host.id resource attribute detector launches the sh and ioreg executables by bare name rather...
CVE-2026-84197
In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from 2.0.0 to 3.9.0 and of its predecessor package @eclipse-ditto/ditto-javascript-client-node1.0 from 1.0.0 to 2.1.0, the WebSocket transport hard-codes rejectUnauthorized: false wh...
CVE-2026-81192
"OpenTelemetry.Resources.Host" NuGet package, which provides OpenTelemetry resource detectors for host, is affected by an untrusted search path vulnerability on macOS. Prior to version 1.16.0-beta.2, the "host.id" resource attribute detector launches the "sh" and "ioreg" executables by bare name...
CVE-2026-81192
CVE-2026-81192 is an untrusted search path vulnerability in the OpenTelemetry.Resources.Host NuGet package, affecting macOS only. The host.id resource attribute detector invokes sh and ioreg by bare name, resolving them through the PATH environment variable rather than by absolute path. A less-pr...
CVE-2026-81192 OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS
OpenTelemetry.Resources.Host NuGet package, which provides OpenTelemetry resource detectors for host, is affected by an untrusted search path vulnerability on macOS. Prior to version 1.16.0-beta.2, the host.id resource attribute detector launches the sh and ioreg executables by bare name rather...
CVE-2026-81192 OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS
OpenTelemetry.Resources.Host NuGet package, which provides OpenTelemetry resource detectors for host, is affected by an untrusted search path vulnerability on macOS. Prior to version 1.16.0-beta.2, the host.id resource attribute detector launches the sh and ioreg executables by bare name rather...
CVE-2026-81192 OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS
OpenTelemetry.Resources.Host NuGet package, which provides OpenTelemetry resource detectors for host, is affected by an untrusted search path vulnerability on macOS. Prior to version 1.16.0-beta.2, the host.id resource attribute detector launches the sh and ioreg executables by bare name rather...
CVE-2026-84197
Eclipse Ditto's Node.js JavaScript client hard-codes rejectUnauthorized: false in its WebSocket transport, disabling TLS certificate chain and hostname validation for every wss:// connection. All released versions of @eclipse-ditto/ditto-javascript-client-node (2.0.0–3.9.0) and its predecessor @e...
CVE-2026-84197
In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from 2.0.0 to 3.9.0 and of its predecessor package @eclipse-ditto/ditto-javascript-client-node1.0 from 1.0.0 to 2.1.0, the WebSocket transport hard-codes rejectUnauthorized: false wh...
CVE-2026-84197
In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from 2.0.0 to 3.9.0 and of its predecessor package @eclipse-ditto/ditto-javascript-client-node1.0 from 1.0.0 to 2.1.0, the WebSocket transport hard-codes rejectUnauthorized: false wh...
EUVD-2026-74162
In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from 2.0.0 to 3.9.0 and of its predecessor package @eclipse-ditto/ditto-javascript-client-node1.0 from 1.0.0 to 2.1.0, the WebSocket transport hard-codes rejectUnauthorized: false wh...
CVE-2026-84197
In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from 2.0.0 to 3.9.0 and of its predecessor package @eclipse-ditto/ditto-javascript-client-node1.0 from 1.0.0 to 2.1.0, the WebSocket transport hard-codes rejectUnauthorized: false wh...
Security Bulletin: Multiple vulnerabilities found in CICS Transaction Gateway Desktop Edition.
Summary Multiple vulnerabilities were identified in third-party components used by CICS Transaction Gateway Desktop Edition, including IBM WebSphere Application Server, IBM WebSphere Application Server Liberty, Apache Tomcat Embed, Logback Classic, Log4j API, and Jackson Databind. To address thes...
Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname
Impact Sensitive information exposure in the Infracost Terraform Cloud/Enterprise integration. Several code paths attached a configured secret token to a request whose host was taken straight from the scanned Terraform, with no check that the host was the trusted endpoint. The condition that...
GHSA-6X6C-W9W9-HV4H Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname
Impact Sensitive information exposure in the Infracost Terraform Cloud/Enterprise integration. Several code paths attached a configured secret token to a request whose host was taken straight from the scanned Terraform, with no check that the host was the trusted endpoint. The condition that...