CVE-2026-71557: Improper Limitation of a Pathname to a Restricted Directory

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name for example containing...

Autodesk FBX SDK < 2020.3.10 Multiple Vulnerabilities (adsk-sa-2026-0010)

The version of FBX SDK installed on the remote host is prior to 2020.3.10. It is, therefore, affected by multiple vulnerabilities as referenced in the adsk-sa-2026-0010 advisory. - A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow...

CVE-2026-69125

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-67321. Reason: This candidate is a duplicate of CVE-2026-67321. Notes: All CVE users should reference CVE-2026-67321 instead of this candidate...

CVE-2026-69124

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-67320. Reason: This candidate is a duplicate of CVE-2026-67320. Notes: All CVE users should reference CVE-2026-67320 instead of this candidate...

CVE-2026-69123

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-67319. Reason: This candidate is a duplicate of CVE-2026-67319. Notes: All CVE users should reference CVE-2026-67319 instead of this candidate...

CVE-2026-68948

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-67318. Reason: This candidate is a duplicate of CVE-2026-67318. Notes: All CVE users should reference CVE-2026-67318 instead of this candidate...

CVE-2026-68947

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-67317. Reason: This candidate is a duplicate of CVE-2026-67317. Notes: All CVE users should reference CVE-2026-67317 instead of this candidate...

CVE-2026-68946

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-67315. Reason: This candidate is a duplicate of CVE-2026-67315. Notes: All CVE users should reference CVE-2026-67315 instead of this candidate...

CVE-2026-68944

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-67316. Reason: This candidate is a duplicate of CVE-2026-67316. Notes: All CVE users should reference CVE-2026-67316 instead of this candidate...

CVE-2026-68943

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-67314. Reason: This candidate is a duplicate of CVE-2026-67314. Notes: All CVE users should reference CVE-2026-67314 instead of this candidate...

CVE-2026-68942

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-67313. Reason: This candidate is a duplicate of CVE-2026-67313. Notes: All CVE users should reference CVE-2026-67313 instead of this candidate...

CVE-2026-19111

Insecure direct object reference in the mongodbmemory, elasticsearchmemory, and mem0memory tools in Amazon Strands Agents Tools before 0.8.3 might allow remote authenticated users to access, modify, or delete memories belonging to other tenants by influencing the LLM to emit tool calls with a...

CVE-2026-67622 Flowise 3.1.4 IDOR in OpenAI Assistants Integration

Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID to Assistants endpoints without workspace ownersh...

CVE-2026-67622 Flowise 3.1.4 IDOR in OpenAI Assistants Integration

Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID to Assistants endpoints without workspace ownersh...

CVE-2026-67622 Flowise 3.1.4 IDOR in OpenAI Assistants Integration

Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID to Assistants endpoints without workspace ownersh...

CVE-2026-67622

Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID to Assistants endpoints without workspace ownersh...

CVE-2026-67622

Flowise 3.1.4 OpenAI Assistants integration contains an insecure direct object reference (IDOR) vulnerability. Authenticated attackers can access credentials from other workspaces by supplying arbitrary credential UUIDs to Assistants endpoints without workspace ownership verification. Attackers c...

MINI-GWPX-34WC-MG4V

Bulletin has no description...

Malicious code in vite-plugin-cleaner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35bc445ea196f979ad69189f4498586a09a51855b97e95dea02d01d197620237 package.json declares an optionalDependency vite-cleaning-tools pointing at github:vite-plugins/vite-cleaning-tools with no commit SHA or tag, so npm...

MAL-2026-13463 Malicious code in vite-plugin-cleaner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35bc445ea196f979ad69189f4498586a09a51855b97e95dea02d01d197620237 package.json declares an optionalDependency vite-cleaning-tools pointing at github:vite-plugins/vite-cleaning-tools with no commit SHA or tag, so npm...