979537 matches found
PT-2026-52905
Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 17.4.0 Description An issue in the RelationQuery performance optimization allows authenticated users to bypass the Relation.visible scope. By providing an arbitrary work package ID through the involved, fromId, or...
ROS-20260626-73-0020
The vulnerability of the ngxhttprewritemodule module in NGINX Plus and NGINX Open Source web servers is related to buffer overflows in dynamic memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or cause a denial-of-service attack by sending a specially crafte...
SUSE SLES15 Security Update : containerized-data-importer (SUSE-SU-2026:2493-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2493-1 advisory. - Security: re-vendor Go dependencies to address CVEs tracked against containerized-data-importer backport of upstream PR 4110,...
PT-2026-52900
Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 17.3.2 OpenProject versions prior to 17.4.0 Description The meetings filter feature in the web application allows an attacker to enumerate existing user accounts by probing user IDs and observing differences in...
PT-2026-52911
Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 17.3.3 OpenProject versions prior to 17.4.1 Description Cache store poisoning allows for Remote Code Execution RCE, a process where an attacker executes arbitrary code on a remote machine. Recommendations Update t...
CVE-2026-40080
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Open Redirect through a substring check rather than a host check at strcontains$referer, CACTIPATHURL. When the user's loginopts == '1' redirect to referer after login, the function use...
DEBIAN-CVE-2026-40080
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Open Redirect through a substring check rather than a host check at strcontains$referer, CACTIPATHURL. When the user's loginopts == '1' redirect to referer after login, the function use...
UBUNTU-CVE-2026-40080
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Open Redirect through a substring check rather than a host check at strcontains$referer, CACTIPATHURL. When the user's loginopts == '1' redirect to referer after login, the function use...
CVE-2026-40080
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Open Redirect through a substring check rather than a host check at strcontains$referer, CACTIPATHURL. When the user's loginopts == '1' redirect to referer after login, the function use...
CVE-2026-44889
A flaw was found in WebOb, a library for HTTP requests and responses. A remote attacker could exploit this vulnerability by influencing the HTTP Location header during a redirect. Due to improper normalization of the Location header, specifically how certain ASCII characters are handled, an...
MAL-2026-6488 Malicious code in pyext6cc8cd (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f98319eaa02d50e8a098d9cfaaca054df5acc8238dd08b2e24899f700e029a07 On pip install, setup.py decodes a hex string via bytes.fromhex"6f70656e202d612043616c63756c61746f72".decode.split to the argv open -a Calculator and...
GO-2026-5773 Gogs has an Open Redirect via redirect_to in gogs.io/gogs
Gogs has an Open Redirect via redirectto in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an edit to...
GO-2026-5714 OpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agent in go.opentelemetry.io/obi
OpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agent in go.opentelemetry.io/obi...
GO-2026-5564 Open Cluster Management (OCM): Cross-cluster privilege escalation via improper Kubernetes client certificate renewal validation in open-cluster-management.io/ocm
Open Cluster Management OCM: Cross-cluster privilege escalation via improper Kubernetes client certificate renewal validation in open-cluster-management.io/ocm...
GO-2026-5604 Docker MCP Gateway: Argument injection via OCI image label YAML in github.com/docker/mcp-gateway
Docker MCP Gateway: Argument injection via OCI image label YAML in github.com/docker/mcp-gateway...
GO-2026-5509 Casdoor vulnerable to Open Redirect in github.com/casdoor/casdoor
Casdoor vulnerable to Open Redirect in github.com/casdoor/casdoor...
GO-2026-5482 free5GC UDR: Fail-open handling in PolicyDataSubsToNotifyPost allows unintended subscription creation in github.com/free5gc/udr
free5GC UDR: Fail-open handling in PolicyDataSubsToNotifyPost allows unintended subscription creation in github.com/free5gc/udr...
GO-2026-5448 Gitea: Open Redirect via redirect_to in code.gitea.io/gitea
Gitea: Open Redirect via redirectto in code.gitea.io/gitea...
GO-2026-5456 OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages in go.opentelemetry.io/obi
OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages in go.opentelemetry.io/obi...