13407 matches found
PT-2026-52980
Name of the Vulnerable Software and Affected Versions Kestra versions prior to 1.0.45 Kestra versions prior to 1.3.23 Description The local internal-storage backend fails to properly validate user-supplied paths because it checks for directory traversal sequences before converting Windows-style...
PT-2026-52909
Name of the Vulnerable Software and Affected Versions RustFS version 1.0.0-beta.4 Description Authenticated users with PutObject permission on their own bucket can exploit a path traversal issue in the Snowball auto-extract feature to write arbitrary objects into buckets belonging to other users,...
EUVD-2026-38381
MessagePack-CSharp: Multi-dimensional array formatters allocate from unchecked dimensions...
EUVD-2026-38392
Filament: Multi-factor authentication app recovery codes can still be used multiple times via concurrent submission...
GHSA-MC5J-F6WX-H9QH Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission
A flaw in the handling of recovery codes for app-based multi-factor authentication allows the same recovery code to be reused via concurrent submission. This issue does not affect email-based MFA. It also only applies when recovery codes are enabled. If an attacker gains access to both the user's...
GO-2026-5290 Axonflow fixed bugs by implementing multi-tenant isolation and access-control hardening in github.com/getaxonflow/axonflow
Axonflow fixed bugs by implementing multi-tenant isolation and access-control hardening in github.com/getaxonflow/axonflow...
GO-2026-5373 Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs) in github.com/radius-project/radius
Radius Controller May Delete a Container Resource via an Injected Deployment Annotation Multi-Tenant Installs in github.com/radius-project/radius...
GO-2026-5371 Kyverno APICall SSRF Vulnerability Leading to Multi-Tenant Isolation Breach in github.com/kyverno/kyverno
Kyverno APICall SSRF Vulnerability Leading to Multi-Tenant Isolation Breach in github.com/kyverno/kyverno...
GO-2026-5226 Oxia's TLS CA certificate chain validation fails with multi-certificate PEM bundles in github.com/oxia-db/oxia
Oxia's TLS CA certificate chain validation fails with multi-certificate PEM bundles in github.com/oxia-db/oxia...
[SECURITY] Fedora 43 Update: goose-1.36.0-1.fc43
Goose is your on-machine AI agent, capable of automating complex development tasks from start to finish. More than just code suggestions, goose can build entire projects from scratch, write and execute code, debug failures, orchestrate workflows, and interact with external APIs - autonomously...
[SECURITY] Fedora 44 Update: goose-1.36.0-1.fc44
Goose is your on-machine AI agent, capable of automating complex development tasks from start to finish. More than just code suggestions, goose can build entire projects from scratch, write and execute code, debug failures, orchestrate workflows, and interact with external APIs - autonomously...
Updated nats-server packages fix security vulnerabilities
nats-server and its dependencies are updated to fix CVE-2025-30215 Missing access controls for JS API in multi-tenancy...
MGASA-2026-0232 Updated nats-server packages fix security vulnerabilities
nats-server and its dependencies are updated to fix CVE-2025-30215 Missing access controls for JS API in multi-tenancy...
MAL-2026-6419 Malicious code in leo-cache (npm)
The leo-cache npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the LeoPlatform...
MAL-2026-6427 Malicious code in leo-connector-redshift (npm)
The leo-connector-redshift npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the...
Malicious code in leo-streams (npm)
The leo-streams npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the LeoPlatform...
Malicious code in leo-cron (npm)
The leo-cron npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the LeoPlatform...
CVE-2026-33235
AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. In versions prior to 0.6.52, the Fill Text Template block is vulnerable to a Denial of Service DoS attack. While the backend implements a SandboxedEnvironment to prevent...
CVE-2026-33235
AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. In versions prior to 0.6.52, the Fill Text Template block is vulnerable to a Denial of Service DoS attack. While the backend implements a SandboxedEnvironment to prevent...