52054 matches found
turso-cli persists Turso platform JWT with world-readable (0o644) file permissions
Summary turso-cli persists the user's Turso platform JWT to settings.json using Viper's default configPermissions of 0o644, leaving the credential file world-readable on standard Linux and macOS systems. Any other local UID on the host can read the file and recover the platform JWT, which grants...
GHSA-57F6-PVX8-HWJ6 turso-cli persists Turso platform JWT with world-readable (0o644) file permissions
Summary turso-cli persists the user's Turso platform JWT to settings.json using Viper's default configPermissions of 0o644, leaving the credential file world-readable on standard Linux and macOS systems. Any other local UID on the host can read the file and recover the platform JWT, which grants...
CVE-2026-50132
Budibase is an open-source low-code platform. Prior to 3.39.0, GET /api/chat-links/:instance/:token/handoff is a public endpoint no auth required that performs a permanent, state-changing operation: it binds an external chat identity Slack/Discord/MS Teams to an authenticated Budibase user accoun...
CVE-2026-54896 vulnerabilities
Vulnerabilities for packages: kube-logging-operator, ruby3.2-fluentd-kubernetes-daemonset, ruby3.4-fluentd-kubernetes-daemonset, ruby3.3-fluentd-kubernetes-daemonset, ruby4.0-fluentd-kubernetes-daemonset...
CVE-2026-30405 vulnerabilities
Vulnerabilities for packages: kube-vip-fips, cilium-cli, kube-vip...
CVE-2026-46604
The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset...
GHSA-52X6-GQ3R-VPF4 vulnerabilities
Vulnerabilities for packages: open-webui...
GHSA-MPWR-8VM7-H73F vulnerabilities
Vulnerabilities for packages: gobuster, crossplane-provider-azure-storage, grafana, telegraf, crossplane-provider-family-azure, nfpm, crossplane-provider-azure-sql, splunk-otel-collector, goreleaser, cert-manager, crossplane-provider-azure-managedidentity, external-secrets-operator,...
CVE-2026-46601 vulnerabilities
Vulnerabilities for packages: mattermost, mailpit, pdfcpu, seaweedfs, kubescape, ollama, gitea, bento, rclone...
EUVD-2026-39840
In the Linux kernel, the following vulnerability has been resolved: usb: typec: ps883x: Fix Oops at unbind When trying to unbind a device in order to bind to it vfio-platform as: echo bc0000.geniqup /sys/bus/platform/devices/bc0000.geniqup/driver/unbind I get the following Oops: 436.478639 Unable...
CVE-2026-53305
In the Linux kernel, the following vulnerability has been resolved: usb: typec: ps883x: Fix Oops at unbind When trying to unbind a device in order to bind to it vfio-platform as: echo bc0000.geniqup /sys/bus/platform/devices/bc0000.geniqup/driver/unbind I get the following Oops: 436.478639 Unable...
EUVD-2026-39884
In the Linux kernel, the following vulnerability has been resolved: drm/gma500/oaktraillvds: fix hang on init failure The LVDS init code looks up an I2C adapter using i2cgetadapter and tries to read the EDID before falling back to allocating and registering its own adapter. The error handling doe...
CVE-2026-57667
creationtimestamp| type| source ---|---|--- 2026-06-26 18:10:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp7k4qx6ij2n 2026-06-30 14:17:12+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpj6xloow725...
CVE-2026-28385
In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery SSRF vulnerability in the image import functionality allows authenticated users with the cancreateimages entitlement to interact with internal network infrastructure via the /images endpoint. When importing an image from a...
EUVD-2026-39801
Dokku is a docker-powered PaaS. Prior to 0.38.2, the app name validation regex ^a-z0-9^/:A-Z$ permits shell metacharacters. When an authenticated user pushes to a git remote with a crafted app name, the name is embedded unquoted into a bash pre-receive hook script via an unquoted heredoc EOF...
CVE-2026-45408
Dokku is a docker-powered PaaS. Prior to 0.38.2, the app name validation regex ^a-z0-9^/:A-Z$ permits shell metacharacters. When an authenticated user pushes to a git remote with a crafted app name, the name is embedded unquoted into a bash pre-receive hook script via an unquoted heredoc...
CVE-2026-56663
AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.52, an authenticated user can bypass the SSRF / private-IP protections in SendWebRequestBlock and reach internal network services. isipblocked in...
CVE-2026-9640
A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy...
