29863 matches found
PT-2026-77800
Vulnerability in the Oracle Project Planning and Control product of Oracle E-Business Suite component: Change Management. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...
PT-2026-77030
Dolibarr contains an authorization bypass vulnerability in the clonetasks mass action that allows authenticated users with project creation permissions to clone tasks into private projects they are not authorized to access. An inverted boolean condition in the private-project membership check...
CVE-2026-34398
FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, src/Mod/BIM/bimcommands/BimProjectManager.py in the BIM Project Manager Load Template flow passes attacker-controlled FCStd Meta property values for wpposition, wpu, wpv, and wpaxis directly to eval,...
CVE-2026-34398
In FreeCAD 0.19 through 1.1.1, the BIM Project Manager's Load Template flow passes attacker-controlled FCStd Meta property values (wpposition, wpu, wpv, wpaxis) directly to Python's eval(), enabling arbitrary code execution when a user opens a malicious BIM project template. Fixed in version 1.1....
CVE-2026-34398
FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, src/Mod/BIM/bimcommands/BimProjectManager.py in the BIM Project Manager Load Template flow passes attacker-controlled FCStd Meta property values for wpposition, wpu, wpv, and wpaxis directly to eval,...
CVE-2026-34398 FreeCAD: Arbitrary Code Execution via eval() on untrusted project file metadata in BIM Workbench
FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, src/Mod/BIM/bimcommands/BimProjectManager.py in the BIM Project Manager Load Template flow passes attacker-controlled FCStd Meta property values for wpposition, wpu, wpv, and wpaxis directly to eval,...
CVE-2026-34398 FreeCAD: Arbitrary Code Execution via eval() on untrusted project file metadata in BIM Workbench
FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, src/Mod/BIM/bimcommands/BimProjectManager.py in the BIM Project Manager Load Template flow passes attacker-controlled FCStd Meta property values for wpposition, wpu, wpv, and wpaxis directly to eval,...
EUVD-2026-60443
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQ...
CVE-2026-75051
In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible...
CVE-2026-75051
JetBrains YouTrack before 2026.2.17917 allowed an authenticated low-privileged user to transfer projects between organisations, breaking tenant isolation. CVSS 8.1 (High) reflects high confidentiality and integrity impact. Upgrade to YouTrack 2026.2.17917 or later to remediate.
CVE-2026-75051
In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible...
EUVD-2026-60250
In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible...
EUVD-2026-60248
In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint...
CVE-2026-75049
In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint...
BIT-JENKINS-2026-70430
Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, allowing attackers with Overall/Manage permission to instantiate arbitrary types related to configuration, including those...
PT-2026-76700
Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2026.2.17917 Description An issue exists that allows the unauthorized transfer of projects between organizations. Recommendations Update to version 2026.2.17917...
PT-2026-73346
Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, allowing attackers with Overall/Manage permission to instantiate arbitrary types related to configuration, including those...
Ray-Project Ray Code Injection Vulnerability
Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari...
PT-2026-76678
UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /create project endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may ...