267932 matches found
CVE-2026-93337 NetworkManager-l2tp Privilege Escalation via pppd Plugin Injection
NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains an improper input validation vulnerability that allows local users with VPN connection creation permissions to inject arbitrary pppd directives by supplying mru or mtu property values containing trailing non-numeric content after a val...
org.apache.karaf.features:spring (>=4.1.0, <=4.4.10), org.apache.karaf.features:spring-legacy (>=4.1.0, <=4.4.10) +1 more potentially affected by CVE-2026-92230 via org.apache.karaf.deployer:org.apache.karaf.deployer.spring (>=4.0.0.m1, <=4.4.10)
org.apache.karaf.deployer:org.apache.karaf.deployer.spring MAVEN version =4.0.0.m1, =4.1.0, =4.1.0, =4.0.0.m1, =4.4.10 Source cves: CVE-2026-92230 Source advisory: MEND:CVE-2026-92230...
Skipper has OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix GHSA-8qqm-fp2q-v734)
Affected component: filters/openpolicyagent/openpolicyagent.go → ExtractHttpBodyOptionally; combined with github.com/open-policy-agent/opa-envoy-plugin envoyauth/request.go → getParsedBody / checkIfHTTPBodyTruncated. Filter: opaAuthorizeRequestWithBody. - Affected versions: = 0.27.33 current HEAD...
CVE-2026-75588
Mattermost Desktop App versions =6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connected server, which allows a network-positioned attacker to load a plugin popout window over an insecure connection via a link using a downgraded URL scheme...
EUVD-2026-81678
Mattermost Desktop App versions =6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connected server, which allows a network-positioned attacker to load a plugin popout window over an insecure connection via a link using a downgraded URL scheme...
CVE-2026-75588
Mattermost Desktop App versions =6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connected server, which allows a network-positioned attacker to load a plugin popout window over an insecure connection via a link using a downgraded URL scheme...
CVE-2026-75588 Mattermost Desktop App plugin popout scheme validation bypass
Mattermost Desktop App versions =6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connected server, which allows a network-positioned attacker to load a plugin popout window over an insecure connection via a link using a downgraded URL scheme...
CVE-2026-75588 Mattermost Desktop App plugin popout scheme validation bypass
Mattermost Desktop App versions =6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connected server, which allows a network-positioned attacker to load a plugin popout window over an insecure connection via a link using a downgraded URL scheme...
HTTP Response Splitting
Overview Affected versions of this package are vulnerable to HTTP Response Splitting via the CORS plugin's handling of the Vary header. An attacker can manipulate cache key behavior and cause inconsistent CORS enforcement by injecting arbitrary values into the response's Vary header through craft...
oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass
Summary A flaw in the CORS plugin allowed the incoming request's Vary header to be reflected into the response, letting a client influence a header that should be controlled solely by the server. Details The CORS plugin previously copied the request's Vary header directly onto the response instea...
Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities (CVE-2026-69247, CVE-2026-69248, CVE-2026-69249)
Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM SOAR QRadar Plugin App has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-69247 DESCRIPTION: cryptography is a package...
Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities (CVE-2026-49476, CVE-2026-49477)
Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM SOAR QRadar Plugin App has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-49476 DESCRIPTION: Soup Sieve is a CSS selector...
Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities (CVE-2026-45409)
Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM SOAR QRadar Plugin App has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-45409 DESCRIPTION: Internationalized Domain Nam...
CVE-2021-43798-Grafana-path-traversal-tester
Grafana Path Traversal Tester This script automates the testing of known Grafana plugin endpoints for potential path traversal vulnerabilities using curl. 🛠 Features Reads target paths from a file e.g. paths.txt Sends HTTP requests using --path-as-is to bypass normalization Captures HTTP status...
CVE-2026-92917 Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_r
Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters printr, vardump, jsonencode, yamlencode, string: GravExtension::assertSandboxDumpSafe determines sandbox state by calling SandboxExtension::isSandboxed without...
Malicious code in leda-mini-css-extract-plugin-backend-radiant (npm)
Source: amazon-inspector 5c4e8c96252e0a5977fee5bfae6a2fa581b05ed4f4f55675f812153ea1063241 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious Package
Overview latam-xp-analytics-plugin-absmartly is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization an...
Malicious code in latam-xp-analytics-plugin-gtm (npm)
Source: ossf-package-analysis 333a48f2dfbcb9ab75608fb120182771732f71543d3bc13c3352b144b3022403 The OpenSSF Package Analysis project identified 'latam-xp-analytics-plugin-gtm' @ 2.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...