141000 matches found
PT-2026-59561
Summary Type: Insecure Direct Object Reference. Five label endpoints — PATCH /workspaces/workspace id/labels/label id, DELETE .../labels/label id, POST .../issues/issue id/labels/label id, DELETE .../issues/issue id/labels/label id, GET .../issues/issue id/labels — gate access on require workspac...
PT-2026-59346
Summary Open WebUI's prompt version-history endpoints authorize the prompt id in the URL but then act on caller-supplied history IDs without verifying that the history row belongs to that prompt history entry.prompt id == prompt.id. Three operations are affected: - GET /api/v1/prompts/id/prompt...
PT-2026-59616
Summary The SSRF mitigation added in commit 33c55da for GHSA-7gvf-3w72-p2pg is incomplete. The PREREQFUNCTION-based private IP check was correctly applied to HTTPChunk download path but not to HTTPRequest used by the parse urls API. An authenticated attacker can supply a URL pointing to an...
PT-2026-59691
Summary The CSS selector parser in soupsieve the CSS selector engine for Beautiful Soup 4 contains a regular expression vulnerable to catastrophic backtracking. When processing an attribute selector with an unterminated quoted value, the VALUE regex pattern in css parser.py enters exponential...
PT-2026-59114
Discovered through manual source code review. Verified by PoC execution against a local dbt-mcp v1.15.1 installation. Summary run dbt command in src/dbt mcp/dbt cli/tools.py constructs the dbt subprocess argument list by appending user-supplied MCP tool parameters without sanitization. Two...
BIT-POSTGRESQL-JDBC-DRIVER-2026-54291 Silent channel-binding authentication downgrade via unsupported certificate algorithms
pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS with channel binding to plain SCRAM-SHA-256 without it, losing the man-in-the-middle protection the setting is meant to...
SUSE-SU-2026:22635-1 Security update for php8
This update for php8 fixes the following issues - Update to versio 8.4.23 - CVE-2026-14355: The AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw bsc1270351...
OPENSUSE-SU-2026:21308-1 Security update for php8
This update for php8 fixes the following issues - Update to versio 8.4.23 - CVE-2026-14355: The AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw bsc1270351...
[SECURITY] Fedora 44 Update: perl-Crypt-DSA-1.22-1.fc44
Crypt::DSA is an implementation of the DSA Digital Signature Algorithm signature verification system. This package provides DSA signing, signature verification, and key generation. DSA Digital Signature Algorithm signatures are no longer considered to be adequate for security. This module should...
[SECURITY] Fedora 43 Update: perl-Crypt-DSA-1.22-1.fc43
Crypt::DSA is an implementation of the DSA Digital Signature Algorithm signature verification system. This package provides DSA signing, signature verification, and key generation. DSA Digital Signature Algorithm signatures are no longer considered to be adequate for security. This module should...
Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer During Install
The jscrambler npm package was compromised, and simply installing its 8.14.0 release runs an infostealer on your machine. Published on July 11, 2026, the malicious version carries a preinstall hook that drops and executes a native binary, one build each for Windows, macOS, and Linux. Socket flagg...
Exploit for Use After Free in Linux Linux_Kernel
CVE-2026-46215 Exploit for Linux 7.0 - 7.8 & Linux Kernel 7.0-...
Exploit for CVE-2026-14894
CVE-2026-14894 — Super Forms ≤ 6.3.313...
Exploit for Path Traversal in Apache Http_Server
CVE-2021-41773 Apache HTTP Server Path Traversal Contribut...
Exploit for Missing Authentication for Critical Function in Mcpjam Inspector
CVE-2026-23744 — MCPJam Inspector Unauthenticated RCE Unauthe...
CVE-2026-14738
A flaw was found in exo. A remote attacker could exploit the use of a weak hashing algorithm within the imagecachekey function of the Vision Feature Cache component. This vulnerability, while difficult to exploit, could potentially allow an attacker to cause hash collisions, leading to a low impa...
Exploit for Integer Overflow or Wraparound in Linux Linux_Kernel
PACKETEDITMEME - CVE-2026-46331 net/sched actpedit parti...
Exploit for CVE-2024-13985
CVE-2024-13985 — Dahua EIMS capturehandle.action Remote Cod...