19534 matches found
CVE-2026-68517
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the corsorigins guard in glances/outputs/glancesrestfulapi.py uses exact list equality instead of wildcard membership, allowing a multi-origin list containing the wildcard to retain corscredentials and expose...
Security Bulletin: Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling
Summary Langflow OSS supports Agentic Assistant generated components and user-supplied custom Python components for workflow development. Weaknesses in code security scanning, runtime validation, custom component execution paths, and trusted code enforcement could allow authenticated users to...
CVE-2026-68518
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, sanitizemustachedict in glances/actions.py sanitizes individual Mustache values before chevron.render, allowing adjacent unescaped Mustache variables to reconstruct shell operators that securepopen executes when...
EUVD-2025-210735
UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /addprompts endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may be...
CVE-2025-27621 UpTrain has a Constant Default API Key
UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the UpTrain backend creates a new default user with a static username, where the username is also used as the default API key. The UpTrain backend also has an open CORS policy. Using...
CVE-2026-19895
A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This affects the function Login::index of the file app/Config/Filters.php of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be...
CVE-2026-19895 opensourcepos Open Source Point of Sale Login Endpoint Filters.php index excessive authentication
A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This affects the function Login::index of the file app/Config/Filters.php of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be...
EUVD-2026-59760
A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This affects the function Login::index of the file app/Config/Filters.php of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be...
GHSA-XC2P-8GGW-6CR5 vulnerabilities
Vulnerabilities for packages: net-kourier, kubernetes-dashboard-api, kitty, flux, victoriametrics-cluster, knative-serving, terraform-mcp-server, flux-source-controller, minio-object-browser, terraform-docs, rancher-telemetry, crossplane-provider-azure-sql, trufflehog, scorecard,...
PT-2026-73035
Name of the Vulnerable Software and Affected Versions opensourcepos Open Source Point of Sale versions prior to 3.4.3 Description An issue exists in the Login Endpoint component within the Login::index function of the app/Config/Filters.php file. This flaw allows for the improper restriction of...
CVE-2026-73569 vulnerabilities
Vulnerabilities for packages: jitsucom-jitsu, tileserver-gl...
GO-2024-2907 vulnerabilities
Vulnerabilities for packages: nuclei...
GO-2025-3604 vulnerabilities
Vulnerabilities for packages: mattermost-fips...
GO-2025-3367 vulnerabilities
Vulnerabilities for packages: kaniko, flux-fips, kaniko-fips, gitea-fips, amazon-ssm-agent, snyk-cli, wolfictl, apko, tfsec, argocd-image-updater, syft, gitea, grafana-alloy, nemo, timoni, argo-events, pulumi, argo-events-fips, goreleaser, trivy, argocd-image-updater-fips, bom, kargo,...
GO-2026-5005 vulnerabilities
Vulnerabilities for packages: prometheus-mongodb-exporter, podman-fips, docker-cli-buildx-fips, kyverno, docker-cli-buildx, prometheus-fips, tigera-operator, kine, external-secrets-operator-fips, prometheus-elasticsearch-exporter, external-dns, aactl, argo-cd, frankenphp-8.5,...
GO-2026-5763 vulnerabilities
Vulnerabilities for packages: tkn, kyverno-policy-reporter-plugins-kyverno, cloudbeat, cosign-fips, chainctl-fips, kyverno-policy-reporter-plugins-kyverno-fips, skaffold-fips, kyverno-notation-aws, docker-cli-buildx-fips, policy-controller, cosign, crossplane-fips, commercial-chainloop-backend,...
GO-2026-4962 vulnerabilities
Vulnerabilities for packages: mattermost...
GO-2025-3565 vulnerabilities
Vulnerabilities for packages: ingress-nginx-controller...
GO-2026-5029 vulnerabilities
Vulnerabilities for packages: traefik, vale, caddy, kubernetes-dashboard, glab, grafana-pyroscope, istio, kots, flux, crossplane-provider-azure-storage, nerdctl, snyk-cli, ingress-nginx-controller, gitea, helm, gptscript, zot, external-secrets-operator, k3s, kyverno, prometheus-operator, fq,...