199771 matches found
EUVD-2026-63380
The Ubuntu-specific language helper scripts save-to-pam-env, update-langlist shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in /.pamenvironment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an...
CVE-2026-61898
CVE-2026-61898 is a shell injection in the Ubuntu-specific language helper scripts (save-to-pam-env , update-langlist ) shipped with accountsservice before version 23.13.9-8ubuntu7 . The user-controlled LANGUAGE entry in ~/.pam_environment is interpolated unescaped into a GNU sed replacement expr...
CVE-2026-61898
The Ubuntu-specific language helper scripts save-to-pam-env, update-langlist shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in /.pamenvironment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an...
CVE-2026-61897
An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 root. A shell spawned by a helper script inherits ruid=0 and may reset its...
EUVD-2026-63379
An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 root. A shell spawned by a helper script inherits ruid=0 and may reset its...
CVE-2026-61897
An Ubuntu-specific AccountsService patch before 23.13.9-8ubuntu7 changes only the effective UID/GID to the target user while leaving the real UID as root (0). A shell spawned by a language helper script inherits ruid=0 and can reset its effective UID to root, enabling local privilege escalation t...
CVE-2026-73220 CVAT: Stored XSS via annotation guides in audio tasks
CVAT is an open source interactive video and image annotation tool for computer vision. From 2.68.0 until 2.70.0, the audio-task annotation guide renderer in cvat-ui/src/audio/components/annotation-page/audio-workspace/top-bar/audio-right-group.tsx passes attacker-controlled guide Markdown to...
CVE-2026-73220
CVAT (open-source video and image annotation tool) is affected by a stored cross-site scripting (XSS) vulnerability in versions 2.68.0 through 2.70.0. The audio-task annotation guide renderer in cvat-ui/src/audio/components/annotation-page/audio-workspace/top-bar/audio-right-group.tsx passes atta...
CVE-2026-73220 CVAT: Stored XSS via annotation guides in audio tasks
CVAT is an open source interactive video and image annotation tool for computer vision. From 2.68.0 until 2.70.0, the audio-task annotation guide renderer in cvat-ui/src/audio/components/annotation-page/audio-workspace/top-bar/audio-right-group.tsx passes attacker-controlled guide Markdown to...
CVE-2026-20319
creationtimestamp| type| source ---|---|--- 2026-08-20 14:25:17+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mtjh6z3l4k26...
CVE-2026-56654
A flaw was found in Gitea. This vulnerability allows an attacker to escalate their privileges by manipulating the scope of an access token within the API. This means an attacker could gain unauthorized access to sensitive functions or data, potentially leading to full control over affected...
GHSA-72X6-4J93-7W86 vulnerabilities
Vulnerabilities for packages: kubescape-server, podman, conftest-fips, scorecard, skaffold-fips, podman-fips, conftest, kaniko, kubescape-server-fips, trivy-operator-fips, cloudbeat-fips, guac, kaniko-fips, kubescape, livekit-cli, cloudbeat...
CVE-2026-61711 vulnerabilities
Vulnerabilities for packages: kubescape-server, podman, conftest-fips, scorecard, skaffold-fips, podman-fips, conftest, kaniko, kubescape-server-fips, trivy-operator-fips, cloudbeat-fips, guac, kaniko-fips, kubescape, livekit-cli, cloudbeat...
CVE-2026-61712 vulnerabilities
Vulnerabilities for packages: kubescape-server, podman, conftest-fips, scorecard, skaffold-fips, podman-fips, conftest, kaniko, kubescape-server-fips, trivy-operator-fips, cloudbeat-fips, guac, kaniko-fips, kubescape, livekit-cli, cloudbeat...
GO-2026-4950 vulnerabilities
Vulnerabilities for packages: dapr...
Azure Arc Elevation of Privilege Vulnerability
Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorized attacker to elevate privileges over a network...
Microsoft Fabric Elevation of Privilege Vulnerability
Relative path traversal in Microsoft Fabric allows an authorized attacker to elevate privileges over a network...
Azure SQL Database Elevation of Privilege Vulnerability
Improper neutralization of special elements used in an sql command 'sql injection' in Azure SQL Database allows an authorized attacker to elevate privileges over a network...