84386 matches found
GHSA-XGCH-X3MX-CM3C safeurl is Missing IPv6 CIDR Ranges in Blocklist
The privateNetworks blocklist was found to be missing newly added CIDR ranges. More specifically, the following CIDR ranges were not being blocked: - 64:ff9b:1::/48: NAT64 local-use prefix RFC 8215 - 5f00::/16: Segment Routing SRv6 SIDs RFC 9602 - 3fff::/20: documentation prefix RFC 9637 -...
CVE-2026-55445
Qinglong is a timed task management platform supporting Python3, JavaScript, Shell, and Typescript. Prior to 2.20.1, the init guard middleware in back/loaders/express.ts checks /api/user/init but not /open/user/init, while rewrite'/open/', '/api/$1' rewrites the whitelisted /open/ path after JWT...
CVE-2026-52893 Wekan: OIDC Account Takeover via Unconditional Email-Based Account Merge in onCreateUser hook
Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan Accounts.onCreateUser hook in server/models/users.js merges OIDC logins into existing accounts when the OIDC email or username matches an existing Wekan user, without verifying ownership or checking emailverified. An attacker...
CVE-2026-52893 Wekan: OIDC Account Takeover via Unconditional Email-Based Account Merge in onCreateUser hook
Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan Accounts.onCreateUser hook in server/models/users.js merges OIDC logins into existing accounts when the OIDC email or username matches an existing Wekan user, without verifying ownership or checking emailverified. An attacker...
CVE-2026-53444 Wekan: Missing authorization on OIDC Meteor methods allows privilege escalation to admin
Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan OIDC-related Meteor methods in packages/wekan-oidc/oidcserver.js, server/models/org.js, and server/models/team.js are globally callable without the admin authorization checks used by their non-OIDC counterparts. Authenticated use...
Improper Authorization
Apollo Portal is vulnerable to Improper Authorization. The vulnerability is due to missing application and namespace permission checks when retrieving releases by ID, which allows an authenticated low-privileged user to access unauthorized release data by supplying a valid release ID...
DEBIAN-CVE-2026-56135
Bulletin has no description...
DEBIAN-CVE-2026-42617
Bulletin has no description...
DEBIAN-CVE-2026-56136
Bulletin has no description...
MINI-C852-29FC-66PV
Bulletin has no description...
MINI-9QF7-PHP5-MMPQ
Bulletin has no description...
MINI-VCPV-VV3W-RW5Q
Bulletin has no description...
MINI-XFCC-HF23-XCH8
Bulletin has no description...
MINI-V5P2-XJV8-J727
Bulletin has no description...
MINI-C76Q-H7RQ-Q8J2
Bulletin has no description...
MINI-2GFQ-GCRP-G4MH
Bulletin has no description...
MINI-W53H-57JJ-GP6H
Bulletin has no description...
MINI-PM8P-X3C8-4XP2
Bulletin has no description...
CVE-2026-62351
TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, source/libs/transport/src/transComm.c transDecompressMsg read STransCompMsg.contLen when pHead-comp == 1 without first validating that the RPC packet contained the 8-byte STransCompMsg structure, causi...
CVE-2026-62348
TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, TDengine Enterprise allowed an authenticated low-privilege SQL user to run KILL SSMIGRATE against an active shared-storage migration because mndProcessKillSsMigrateReq called mndKillSsMigrate while the...