123745 matches found
CVE-2026-28603
CVE-2026-28603 is a local escalation of privilege vulnerability in the Android system component AppRestrictionsFragment.java, specifically in the assertSafeToStartCustomActivity method. The root cause is a confused deputy flaw that permits read/write access to private files. Exploitation requires...
CVE-2026-48707 InstantCMS vulnerable to SSRF via upload redirect bypass allows internal network service scanning
InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery SSRF vulnerability in the file upload functionality system/core/uploader.php at lines 509-532. When the "upload from URL" feature follows an HTTP redirect, the redirected...
CVE-2026-77097
Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability. Software customers upgrade to resolved maintenance release. Update Private Metrics Server...
CVE-2026-77098
Private Metrics Server contained an SQL injection condition affecting database operations. Software customers upgrade to resolved maintenance release. Update Private Metrics Server...
CVE-2026-77098 Private Metrics Server SQL Injection
Private Metrics Server contained an SQL injection condition affecting database operations. Software customers upgrade to resolved maintenance release. Update Private Metrics Server...
EUVD-2026-72725
Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability. Software customers upgrade to resolved maintenance release. Update Private Metrics Server...
CVE-2026-77098 Private Metrics Server SQL Injection
Private Metrics Server contained an SQL injection condition affecting database operations. Software customers upgrade to resolved maintenance release. Update Private Metrics Server...
CVE-2026-77097 Private Metrics Server Denial of Service
Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability. Software customers upgrade to resolved maintenance release. Update Private Metrics Server...
CVE-2026-77097
Commvault Private Metrics Server is affected by a missing authentication condition that impacts the metrics upload functionality, allowing an unauthenticated network-based attacker to cause a denial of service (high availability impact, low integrity impact). The CNA (Commvault) rates this CVSS 4...
EUVD-2026-72726
Private Metrics Server contained an SQL injection condition affecting database operations. Software customers upgrade to resolved maintenance release. Update Private Metrics Server...
CVE-2026-77098
Commvault Private Metrics Server is affected by an SQL injection vulnerability affecting database operations, rated CVSS 3.1: 9.8 (CRITICAL) and CVSS 4.0: 8.8 (HIGH) . CISA SSVC assesses exploitation as "none," automatable as "yes," and technical impact as "partial." No public exploit details are...
PT-2026-87047
Private Metrics Server contained an SQL injection condition affecting database operations. Software customers upgrade to resolved maintenance release. Update Private Metrics Server...
CVE-2026-82586 AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes
Improper Protection of Alternate Path vulnerability in ash-project ashlua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list. AshLua exposes Ash resources to Lua scripts, gated by a manifest declaring which fields are exposed. The read action's...
EEF-CVE-2026-82586 AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes
Summary Improper Protection of Alternate Path vulnerability in ash-project ashlua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list. AshLua exposes Ash resources to Lua scripts, gated by a manifest declaring which fields are exposed. The read action...
CVE-2026-82586
ash_lua (ash-project) is an Elixir library that exposes Ash resources to Lua scripts, with a manifest-gated allow-list controlling which fields scripts may read. The operation aggregate path in AshLua.Runtime resolved field names via String.to_existing_atom and Ash.Query.Aggregate.new! without co...
CVE-2026-82586 AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes
Improper Protection of Alternate Path vulnerability in ash-project ashlua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list. AshLua exposes Ash resources to Lua scripts, gated by a manifest declaring which fields are exposed. The read action's...
CVE-2026-86489
In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders across organizations...
CVE-2026-86489
In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders across organizations...