EUVD-2026-58543

OpenChoreo is a developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.1, the OpenChoreo Backstage backend hardcoded backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOutsideDevelopment to true, exposing /api/ without authentication and allowing...

.NET: .NET Information Disclosure Vulnerability

Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network...

CVE-2026-73505

Oh My Posh is affected by CVE-2026-73505 due to setStyle() rendering the path via Go templates, exposing a cmd function in the template map. An attacker-controlled directory name containing a Go template expression could execute arbitrary OS commands as the current user when the prompt renders in...

.NET: .NET Elevation of Privilege Vulnerability

Uncaught exception in .NET allows an authorized attacker to elevate privileges locally...

CVE-2026-0291

An improper link resolution before file access vulnerability exists in the Palo Alto Networks Prisma® Access Agent on Linux platforms that enables a local low privileged user to delete system files in a limited scope and disable Prisma Access Agent. The Prisma Access Agent on macOS, Windows, iOS,...

CVE-2026-0293

A vulnerability in Palo Alto Networks Prisma® Access Agent on Windows enables a local attacker with administrator privileges to bypass the anti-tamper protection, enabling unauthorized access to protected processes and files. The Prisma Access Agent on Linux, macOS, iOS, Android, and Chrome OS is...

EUVD-2026-57707

A vulnerability in Palo Alto Networks Prisma® Access Agent on Windows enables a local attacker with administrator privileges to bypass the anti-tamper protection, enabling unauthorized access to protected processes and files. The Prisma Access Agent on Linux, macOS, iOS, Android, and Chrome OS is...

CVE-2026-50544: Creation of Temporary File in Directory with Insecure Permissions

NortheBridge/luminalshine is a Sunshine-compatible game stream host for Moonlight. Prior to version 26.05.0-rc4, a latent gap exists on a default install, the file at src/platform/windows/misc.cpp lives at C:\ProgramData\LuminalShine\config\apps.json and is created by the SYSTEM service. Under...

PT-2026-71374

An improper link resolution before file access vulnerability exists in the Palo Alto Networks Prisma® Access Agent on Linux platforms that enables a local low privileged user to delete system files in a limited scope and disable Prisma Access Agent. The Prisma Access Agent on macOS, Windows, iOS,...

CVE-2026-73307

creationtimestamp| type| source ---|---|--- 2026-08-12 20:35:17+00:00| published-proof-of-concept| https://github.com/Budibase/budibase/security/advisories/GHSA-hfhx-w8p8-4hc7...

iris-web v2.4.29

Incident Response Investigation System Current Version v2.4.20 Online Demonstration IRIS Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. Table of contents Getting Started Run IrisWeb Configuration Versioning Showcase...

EUVD-2026-57509

Budibase is an open-source low-code platform. Prior to 3.40.1, packages/server/src/integrations/mongodb.ts passed builder-controlled tlsCertificateKeyFile and tlsCAFile values directly to MongoClient on Budibase Cloud. A builder could submit absolute server paths through /api/datasources/verify a...

CVE-2026-73407

Budibase CVE-2026-73407: Unauthenticated REST datasource credential theft via cross-origin auth leak in RestIntegration._req (packages/server/src/integrations/rest.ts) prior to 3.40.1. An unauthenticated caller of a PUBLIC POST /api/v2/queries/:queryId could supply an absolute or parameterized pa...

CVE-2026-73306

Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the failure counter in packages/worker/src/api/controllers/global/auth.ts only for existing users, while packages/worker/src/middleware/emailLockout.ts returned X-Account-Locked and...

CVE-2026-73306 Budibase: Account Enumeration via Login Lockout Response Differential

Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the failure counter in packages/worker/src/api/controllers/global/auth.ts only for existing users, while packages/worker/src/middleware/emailLockout.ts returned X-Account-Locked and...

ld-platform (>=0.1.2, <=0.2.0), spswarehouse-airflow (0.6.3) potentially affected by CVE-2026-68969 via apache-airflow (2.5.0)

apache-airflow PYPI version 2.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - ld-platform =0.1.2, =0.2.0 - spswarehouse-airflow 0.6.3 Source cves: CVE-2026-68969 Source advisory: OSV:GHSA-CJV4-7HP2-2X9H...

ld-platform (>=0.1.2, <=0.2.0), spswarehouse-airflow (0.6.3) potentially affected by CVE-2026-68970 via apache-airflow (2.5.0)

apache-airflow PYPI version 2.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - ld-platform =0.1.2, =0.2.0 - spswarehouse-airflow 0.6.3 Source cves: CVE-2026-68970 Source advisory: OSV:GHSA-F3C2-J7G8-VPP8...

ld-platform (>=0.1.2, <=0.2.0), spswarehouse-airflow (0.6.3) potentially affected by CVE-2026-68971 via apache-airflow (2.5.0)

apache-airflow PYPI version 2.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - ld-platform =0.1.2, =0.2.0 - spswarehouse-airflow 0.6.3 Source cves: CVE-2026-68971 Source advisory: OSV:GHSA-5247-M8W9-2V4M...

ld-platform (>=0.1.2, <=0.2.0), spswarehouse-airflow (0.6.3) potentially affected by CVE-2026-54183 via apache-airflow (2.5.0)

apache-airflow PYPI version 2.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - ld-platform =0.1.2, =0.2.0 - spswarehouse-airflow 0.6.3 Source cves: CVE-2026-54183 Source advisory: OSV:GHSA-G4QJ-5VXV-WGGF...

ld-platform (>=0.1.2, <=0.2.0), spswarehouse-airflow (0.6.3) potentially affected by CVE-2026-68968 via apache-airflow (2.5.0)

apache-airflow PYPI version 2.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - ld-platform =0.1.2, =0.2.0 - spswarehouse-airflow 0.6.3 Source cves: CVE-2026-68968 Source advisory: OSV:GHSA-J4JC-CQ9H-XRHR...