60727 matches found
EUVD-2025-210646
When internal roles are removed from a user within the WSO2 product, the system fails to invalidate any previously issued authentication tokens associated with that user. This vulnerability could allow users to retain their previous access privileges even after their roles have been revoked. As a...
Electron Context Isolation Full Access
The vulnerability of the context isolation mechanism of the Electron application development platform is related to the breach of data protection mechanisms. Exploiting this vulnerability allows an attacker operating remotely to gain full access to the system...
CVE-2026-48169: Authorization Bypass Through User-Controlled Key
PraisonAI is a multi-agent teams system. Versions prior to 0.1.4 of the PraisonAI Platform API have two authorization failures that together break workspace isolation. The service layer for issues and projects performs global primary-key lookups without checking workspace ownership, so any...
Linux Distros Unpatched Vulnerability : CVE-2026-19158
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Views in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker who convinced a user to engage in specific UI gestures to...
Linux Distros Unpatched Vulnerability : CVE-2026-19143
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient validation of untrusted input in WebAPKs in Google Chrome on Android prior to 151.0.7922.109 allowed a local attacker to potentially perform a...
CVE-2026-48047: Path Traversal: '../filedir'
XWiki Platform WebJars API is a package for XWiki, a generic wiki platform. Starting with version 9.6-rc-1 and prior to versions 16.10.17, 17.4.9, and 17.10.3, a potential path traversal vulnerability allow an attacker who manages to get a malicious WebJar extension installed on the wiki to write...
RHEL 9 : RHEL AI 3.6 RPM runtime CVE fix - thrift (Important) (RHSA-2026:51358)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:51358 advisory. RPM packages are internal build artifacts and not supported on their own. They are only supported as part of the Red Hat AI application platform...
nightingale v9.1.0
Open-Source Alerting Expert English | δΈζ π― What is Nightingale Nightingale is an open-source monitoring project that focuses on alerting. Similar to Grafana, Nightingale also connects with various existing data sources. However, while Grafana emphasizes visualization, Nightingale places greater...
Rocket.Chat v8.7.0-rc.6
The ultimate secure open-source solution for team communications Rocket.Chat is an open-source, secure, fully customizable communications platform developed in TypeScript for organizations with high standards of data protection. We are the ultimate solution for team communications, enabling...
CVE-2026-71555
PILOS Platform for Interactive Live-Online Seminars is a frontend for BigBlueButton. From 2.1.0 until 4.14.1, PILOS does not send a Cross-Origin-Opener-Policy response header, so pages opened by PILOS via a link that opens a new browsing context e.g., target="blank" retain a window.opener referen...
DEBIAN-CVE-2026-19158
Use after free in Views in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...
CVE-2026-71555
PILSOS (the PILOS frontend for BigBlueButton) is affected from version 2.1.0 through 4.14.1 by missing Cross-Origin-Opener-Policy headers, allowing reverse tabnabbing via links that open new browsing contexts (target="_blank"). A malicious destination page could access window.opener to navigate o...
CVE-2026-71555
PILOS Platform for Interactive Live-Online Seminars is a frontend for BigBlueButton. From 2.1.0 until 4.14.1, PILOS does not send a Cross-Origin-Opener-Policy response header, so pages opened by PILOS via a link that opens a new browsing context e.g., target="blank" retain a window.opener referen...
CVE-2026-71555 PILOS: Reverse tabnabbing in room description
PILOS Platform for Interactive Live-Online Seminars is a frontend for BigBlueButton. From 2.1.0 until 4.14.1, PILOS does not send a Cross-Origin-Opener-Policy response header, so pages opened by PILOS via a link that opens a new browsing context e.g., target="blank" retain a window.opener referen...
CVE-2026-71555 PILOS: Reverse tabnabbing in room description
PILOS Platform for Interactive Live-Online Seminars is a frontend for BigBlueButton. From 2.1.0 until 4.14.1, PILOS does not send a Cross-Origin-Opener-Policy response header, so pages opened by PILOS via a link that opens a new browsing context e.g., target="blank" retain a window.opener referen...
CVE-2026-48086
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANTADMIN promotes themselves to platform-wide GLOBALADMIN through a single PUT request. The role-update handler accepts the GLOBALADMIN enum value from any tena...
CVE-2026-48086
OpenReceptionβs appointment-booking software (preβ1.0.2) allows a TENANT_ADMIN to promote themselves to GLOBAL_ADMIN via a single PUT to the role-update handler. The handler accepts GLOBAL_ADMIN from any tenant admin updating their own staff, with no policy enforcing that only an existing GLOBAL_...
CVE-2026-48086 OpenReception: Tenant admin self-promotes to GLOBAL_ADMIN
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANTADMIN promotes themselves to platform-wide GLOBALADMIN through a single PUT request. The role-update handler accepts the GLOBALADMIN enum value from any tena...
CVE-2026-48086 OpenReception: Tenant admin self-promotes to GLOBAL_ADMIN
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANTADMIN promotes themselves to platform-wide GLOBALADMIN through a single PUT request. The role-update handler accepts the GLOBALADMIN enum value from any tena...
CyberStrikeAI v1.7.12
CyberStrikeAI δΈζ | English The system of action for AI-native cybersecurityβwhere intent becomes governed execution, evidence becomes operational memory, and every operation improves the next. CyberStrikeAI connects planning, execution, human oversight, evidence, and replay in one auditable...