54615 matches found
CVE-2026-64628 Grav Stored Cross-Site Scripting via Shortcode Attribute Handlers
Grav contains a stored cross-site scripting vulnerability in shortcode-core attribute handlers where the XSS detection scan only matches payloads containing literal angle brackets, allowing shortcode parameters to bypass validation. Attackers with admin.pages permission can inject malicious...
CVE-2026-64628
Grav (CVE-2026-64628) suffers a stored XSS in shortcode-core attribute handlers. The XSS bypasses validation because the detector only flags payloads with literal angle brackets, allowing shortcode parameters to inject JavaScript that runs in any viewer’s browser, including admins. Attackers with...
CVE-2026-8593
Improper permission enforcement in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 EOL allows users without permissions to view and modify BI packs and rules...
CVE-2026-8593 Fix Business Intelligence API Pack permission
Improper permission enforcement in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 EOL allows users without permissions to view and modify BI packs and rules...
CVE-2026-8593
Improper permission enforcement in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 EOL allows users without permissions to view and modify BI packs and rules...
PT-2026-61983
A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc...
PT-2026-63297
Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description A route-specific authorization failure allows a personal access token restricted to the public-only scope to retrieve private organization membership and permission details. While direct access...
CVE-2026-57495
CVE-2026-57495 affects AgenticMail components @agenticmail/claudecode (<0.2.39), @agenticmail/codex (<0.1.33), @agenticmail/core (<0.9.43), and @agenticmail/openclaw (
CVE-2026-57495 AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)
AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/claudecode prior to version 0.2.39, @agenticmail/codex prior to version 0.1.33, @agenticmail/core prior to version 0.9.43, and @agenticmail/openclaw prior to version 0.5.71, two inbound-mail handlers act on a...
CVE-2026-57495 AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)
AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/claudecode prior to version 0.2.39, @agenticmail/codex prior to version 0.1.33, @agenticmail/core prior to version 0.9.43, and @agenticmail/openclaw prior to version 0.5.71, two inbound-mail handlers act on a...
EUVD-2026-46124
AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/claudecode prior to version 0.2.39, @agenticmail/codex prior to version 0.1.33, @agenticmail/core prior to version 0.9.43, and @agenticmail/openclaw prior to version 0.5.71, two inbound-mail handlers act on a...
GHSA-GJFG-22FP-RRXX Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files
Summary A Composer package declares its executables in the bin field of its composer.json. When Composer installs a package, it processes each bin entry and changes the file mode of the corresponding file so it is executable. If a bin entry contains .. path segments, it can resolve to a path...
EUVD-2026-44673
Directus: Authorization-dependent response served from unsegmented cache key...
EUVD-2026-42272
File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope...
CVE-2026-44509
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-43619. Reason: This candidate is a duplicate of CVE-2026-43619. Notes: All CVE users should reference CVE-2026-43619 instead of this candidate...
DEBIAN-CVE-2026-44509
Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local files. In versions prior to 3.4.3, previous bug fixes for symlink races in open calls missed races in other path based system calls like chmod and chown. For rsync daemons with "use chroot = no" this...
CVE-2026-44509
Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local files. In versions prior to 3.4.3, previous bug fixes for symlink races in open calls missed races in other path based system calls like chmod and chown. For rsync daemons with "use chroot = no" this...
CVE-2026-44509
Rsync vulnerability CVE-2026-44509 (connected to CVE-2026-43619) concerns the rsync daemon when use chroot is set to no. Prior to 3.4.3, fixes for symlink race issues in open() did not cover races in other path-based calls such as chmod() and chown(), enabling a local attacker with filesystem acc...
