23320 matches found
CVE-2026-105867
The Payload headless content management system contains a vulnerability in the @payloadcms/storage-s3 component (versions before 3.90.0 and canary versions before 4.0.0-canary.34 ). An authenticated user can overwrite an existing S3 object belonging to a different upload collection if multiple co...
CVE-2026-105867 Payload: Client uploads could overwrite S3 objects
Payload is a free and open source headless content management system. In @payloadcms/storage-s3 versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user can overwrite an existing S3 object belonging to another upload collection when client uploads are enabled for...
CVE-2026-105867 Payload: Client uploads could overwrite S3 objects
Payload is a free and open source headless content management system. In @payloadcms/storage-s3 versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user can overwrite an existing S3 object belonging to another upload collection when client uploads are enabled for...
CVE-2026-105867 Payload: Client uploads could overwrite S3 objects
Payload is a free and open source headless content management system. In @payloadcms/storage-s3 versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user can overwrite an existing S3 object belonging to another upload collection when client uploads are enabled for...
CVE-2026-105867
Payload is a free and open source headless content management system. In @payloadcms/storage-s3 versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user can overwrite an existing S3 object belonging to another upload collection when client uploads are enabled for...
Important: Red Hat Security Advisory: grafana security update
An update for grafana is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
grafana: Grafana: Privilege escalation via dashboard overwrite
A flaw was found in Grafana. A user with editor privileges can overwrite a dashboard not owned by them, leading to privilege escalation on that specific dashboard. This allows the editor to gain administrative control over the affected dashboard...
grafana: Grafana: Privilege escalation via dashboard overwrite
A flaw was found in Grafana. A user with editor privileges can overwrite a dashboard not owned by them, leading to privilege escalation on that specific dashboard. This allows the editor to gain administrative control over the affected dashboard...
openssh: OpenSSH: sftp client allows attacker to control downloaded file location
A flaw was found in OpenSSH. The sftp client, when used to download files from a malicious server with the 'sftp server:/path .' command, does not properly restrict where those files are saved. This allows an attacker to control the download location, potentially overwriting existing files or...
CVE-2026-105840
lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath in src/lrz.c only rejects '../' sequences unless built with...
CVE-2026-105789
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the executecommand tool in ufo/client/mcp/httpservers/linuxmcpserver.py treats sort and uniq as read-only commands while the free-form command parameter can select their file-output...
EUVD-2026-93406
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the executecommand tool in ufo/client/mcp/httpservers/linuxmcpserver.py treats sort and uniq as read-only commands while the free-form command parameter can select their file-output...
CVE-2026-105789
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the executecommand tool in ufo/client/mcp/httpservers/linuxmcpserver.py treats sort and uniq as read-only commands while the free-form command parameter can select their file-output...
[SECURITY] [DLA 4825-1] suricata-update security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-4825-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz October 06, 2026 https://wiki.debian.org/LTS -...
DEBIAN-CVE-2026-98361
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Restore HMMPFNWRITE check in ODP write paths Commit 0b261d7c1cd3 "RDMA/rxe: Break endless pagefault loop for RO pages" dropped the access permission test from rxecheckpagefault and left only HMMPFNVALID. A page faulted ...
UBUNTU-CVE-2026-98361
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Restore HMMPFNWRITE check in ODP write paths Commit 0b261d7c1cd3 "RDMA/rxe: Break endless pagefault loop for RO pages" dropped the access permission test from rxecheckpagefault and left only HMMPFNVALID. A page faulted ...
CVE-2026-98361
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Restore HMMPFNWRITE check in ODP write paths Commit 0b261d7c1cd3 "RDMA/rxe: Break endless pagefault loop for RO pages" dropped the access permission test from rxecheckpagefault and left only HMMPFNVALID. A page faulted ...
CVE-2026-98361
The Linux kernel is vulnerable to a memory corruption issue in the RDMA/rxe driver due to the removal of the access permission test in rxe_check_pagefault(). This allows ODP write operations (such as RDMA WRITE , RDMA READ response , SEND payload , and atomics ) to modify read-only page-cache fol...
EUVD-2026-93346
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Restore HMMPFNWRITE check in ODP write paths Commit 0b261d7c1cd3 "RDMA/rxe: Break endless pagefault loop for RO pages" dropped the access permission test from rxecheckpagefault and left only HMMPFNVALID. A page faulted ...
CVE-2026-89289
The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying its id...