21554 matches found
CVE-2026-66375: Missing Authorization
A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions...
PT-2026-70960
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/vmwgfx component where the vmw surface metadata::array size field, which is provided by userspace, is not properly validated against specific limits based on t...
Linux Distros Unpatched Vulnerability : CVE-2026-68384
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Fix VF CCS attach/detach race with in-flight BO moves xebomove attaches VF CCS...
PT-2026-71099
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A low-privilege authenticated user can permanently delete protected internal metadata across multiple repositories under specific conditions. Recommendations At...
PT-2026-71232
Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An information disclosure issue exists in the /api/notebook/getNotebookInfo endpoint. The system fails to perform proper authorization checks, allowing users with read-only roles or anonymous readers ...
PT-2026-71103
Name of the Vulnerable Software and Affected Versions Puppet affected versions not specified Description An authenticated user can view private Puppet module metadata even if they do not have the required repository read access. Recommendations At the moment, there is no information about a newer...
CVE-2026-19002: Buffer Copy without Checking Size of Input
A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Driver can result in an out-of-bounds write in the client application process. Triggering this issue requires control over the server the driver connects to, or the ability to respond in its...
CVE-2026-66380: Missing Authorization
An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions...
CVE-2026-66378: Missing Authorization
An authenticated user without repository read permission may access private NuGet metadata under specific conditions...
CVE-2026-73290: Incorrect Authorization
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, an anonymous ListObjectVersions request in rustfs/src/storage/access.rs that lacks a direct bucket-policy grant falls back to an s3:ListBucket check and returns before the policyallowed path applies...
CVE-2026-70547: Missing Authorization
An authenticated user without repository read permission may access package metadata under specific conditions...
CVE-2026-69106: Improper Input Validation
A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content...
PT-2026-71195
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A low-privileged user can poison cached artifact metadata under specific conditions. This action may lead consumers to retrieve untrusted content. Recommendation...
PT-2026-71135
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated user who lacks repository read permissions may be able to access package metadata under specific conditions. Recommendations At the moment, ther...
PT-2026-71104
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated user who lacks repository read permissions can access private OCI Open Container Initiative referrer metadata under specific conditions. OCI...
CVE-2026-16033: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory specifically affecti...
CVE-2026-8667: Incorrect Authorization
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer role to modify certain package registry metadata without the required...
CVE-2026-18943: Exposure of Sensitive Information to an Unauthorized Actor
The WPC Admin Columns WordPress plugin before 2.3.4 does not have authorisation checks in one of its AJAX actions, allowing users with a role as low as subscriber to read arbitrary user, post and term metadata, including data belonging to administrators...
CVE-2026-72790: Missing Authorization
SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/notebook/getNotebookInfo endpoint that returns notebook metadata without authorization checks. Attackers can read notebook names, document counts, sizes, and timestamps for closed or non-published notebooks that...