138 matches found
CVE-2026-21636
CVE-2026-21636 - Node.js Permission Model UDS/Network Bypass Vulnerability summary The Node.js permission model --permission is designed to sandbox a process by restricting access to the filesystem, child processes, workers, and network. CVE-2026-21636 reveals that connections made via undici/fet...
CVE-2026-119404
Improper access control in Windows Client for NFS allows an unauthorized attacker to bypass a security feature over a network...
EUVD-2026-122335
Improper access control in Windows Client for NFS allows an unauthorized attacker to bypass a security feature over a network...
PT-2026-144008
Trust boundary violation in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...
PT-2026-143834
Improper access control in Windows Client for NFS allows an unauthorized attacker to bypass a security feature over a network...
CVE-2026-123119
A flaw was found in the Symfony HttpClient component. The client fails to properly pin verified IP addresses for cached hostnames across subsequent requests, causing the host to be re-resolved. A remote attacker controlling an external Domain Name System DNS server can exploit this behavior throu...
Linux Distros Unpatched Vulnerability : CVE-2026-123119
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Symfony HttpClient component NoPrivateNetworkHttpClient does not pin the checked IP address of cached hosts, allowing for DNS rebinding to bypass private...
CVE-2026-68935
Chartbrew is an open-source web application for creating charts from databases and APIs. In versions 4.8.5 through 5.2.2, API connection creation and update operations accept the internal allowPrivateHost field from user input. An authenticated user with permission to manage API connections can...
EUVD-2026-118510
Chartbrew is an open-source web application for creating charts from databases and APIs. In versions 4.8.5 through 5.2.2, API connection creation and update operations accept the internal allowPrivateHost field from user input. An authenticated user with permission to manage API connections can...
CVE-2026-68935
The open-source web application Chartbrew versions 4.8.5 through 5.2.2 is vulnerable to a Server-Side Request Forgery (SSRF) . The root cause is that API connection creation and update operations accept the internal allowPrivateHost field from user input. An authenticated user with permissions to...
UBUNTU-CVE-2026-123119
The Symfony HttpClient component NoPrivateNetworkHttpClient does not pin the checked IP address of cached hosts, allowing for DNS rebinding to bypass private network restrictions, resulting in enumeration of internal hosts and ports in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x...
PT-2026-138449
Name of the Vulnerable Software and Affected Versions Chartbrew versions 4.8.5 through 5.2.2 Description An authenticated user with permissions to manage API connections can bypass private and reserved-network destination restrictions. This occurs because API connection creation and update...
CVE-2026-57144
The praisonai package (versions 4.5.110 through 4.6.58 ) is vulnerable to a Protection Mechanism Failure in its SandlockSandbox component. When the optional sandlock module is present but the host kernel lacks Landlock support, the execute() and run_command() functions fail open by silently falli...
CVE-2026-57144 PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable
PraisonAI is a multi-agent teams system. From version 4.5.110 to before version 4.6.61, praisonai.sandbox.SandlockSandbox is documented and implemented as the kernel-enforced sandbox backend for untrusted code. Its SandboxConfig.native path lets callers configure allowed filesystem paths and...
PT-2026-115845
When migrations ALLOWED DOMAINS was configured, a hostname matching the allow list was accepted without checking its resolved address against the local-network restrictions. A user who can start repository migrations and control the DNS of an allowed hostname could make it resolve to loopback or...
CVE-2026-96957
Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network...
UBUNTU-CVE-2026-96957
Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network...
CVE-2026-69982: Weak Authentication
Weak authentication in Active Directory Federation Services AD FS allows an unauthorized attacker to bypass a security feature over a network...
CVE-2026-96957: Improper Verification of Cryptographic Signature
Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network...
