35998 matches found
CVE-2026-49307
Permission control vulnerability in the multi-mode input module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...
EUVD-2026-60067
Permission control vulnerability in the multi-mode input module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...
CVE-2026-49307
Permission control vulnerability in the multi-mode input module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...
CVE-2026-49307
Permission control vulnerability in the multi-mode input module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...
CVE-2026-49307
CVE-2026-49307 describes a permission control vulnerability in the device’s multi-mode input module, affecting confidentiality. CVSS 3.1 base score 6.2 (MEDIUM); attack vector LOCAL, complexity LOW, privileges NONE, user interaction NONE, scope UNCHANGED, with confidentiality impact HIGH. There a...
CVE-2026-65913
A flaw was found in DOMPurify. This prototype pollution vulnerability, specifically when operating in USEPROFILES mode, allows a remote attacker to bypass attribute filtering. By manipulating Array.prototype properties, an attacker can cause DOMPurify to accept event handlers as allowed attribute...
CVE-2026-65904
A flaw was found in DOMPurify. When DOM elements originating from a different window or realm, such as an iframe's contentDocument, are processed in INPLACE mode, DOMPurify fails to properly sanitize them. This oversight allows an attacker to inject and execute Cross-Site Scripting XSS payloads,...
CVE-2026-65901
A flaw was found in DOMPurify. This cross-site scripting XSS vulnerability exists in INPLACE mode, where the software trusts attacker-controlled nodeName on live non-form nodes. A remote attacker can supply hostile live Document Object Model DOM objects with script children. These scripts can...
BIT-AIRFLOW-2026-65017 Apache Airflow: Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass)
Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could...
BIT-CONSUL-2026-16326 consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability CVE-2026-16326 is fixed in consul-mcp-server 0.1.4...
CVE-2026-52886: Improper Limitation of a Pathname to a Restricted Directory
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, Notepad++ validates the backupFilePath attribute from session.xml with std::wstring::startswith against the expected backup directory without path normalization, allowing parent-directory sequences during snapshot-mode...
Medium: kernel
Issue Overview: In the Linux kernel, the following vulnerability has been resolved: smb: client: mask server-provided mode to 07777 in modefromsid CVE-2026-64379 Affected Packages: kernel Note: This advisory is applicable to Amazon Linux 2 - Kernel-5.4 Extra. Visit this page to learn more about...
CVE-2026-74871: Use of Password Hash With Insufficient Computational Effort
opensslencrypt versions before 1.4.6 contain a key derivation flaw in sequential XOR composition mode where the last stage cancels out during key generation. When configured with a single KDF and no prior hashing stage, attackers can bypass memory-hard key derivation and perform offline password...
CVE-2026-49307: Exposure of Sensitive Information to an Unauthorized Actor
Permission control vulnerability in the multi-mode input module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...
Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-100921)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100921 advisory. Sandbox escape in the Responsive Design Mode component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and...
webpack_devserver 5.2.5 - CSRF
Exploit Title: webpackdevserver 5.2.5 - Csrf Date: 2026-07-17 Exploit Author: Pig-Tail Jorge González Milla Vendor Homepage: https://github.com/webpack/webpack-dev-server Software Link: https://www.npmjs.com/package/webpack-dev-server Version: reaches launchEditorfileName from a CROSS-ORIGIN...
CVE-2026-40144: Out-of-bounds Read
A memory-corruption vulnerability exists in a kernel-mode component of BeyondTrust Endpoint Privilege Management Windows deployments prior to version 26.1.2. Insufficient validation of input processed by the component may result in memory being accessed outside its intended bounds...
PT-2026-73241
Apache Airflow's asset materialization endpoint POST /api/v2/assets/asset id/materialize and the XCom result check on wait dag run until finished authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a...
PT-2026-73239
Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplied, and its pattern could not match a team name containing an underscore, which team names are...