29301 matches found
Fission: Cross-namespace Package read via unvalidated PackageRef in Function admission webhook
Summary A Fission Function spec carries three reference types — Secret, ConfigMap, and Package. The first two were namespace-validated by the admission webhook; PackageRef.Namespace was not. Details A tenant with functions.fission.io/create in their own namespace could set...
EUVD-2026-36096
Fission: Cross-namespace Package read via unvalidated PackageRef in Function admission webhook...
CVE-2026-10653
The CVE-2026-10653 issue affects the Zephyr net_buf library (lib/net_buf/buf.c). It relies on non-atomic operations for two reference counters: the per-header buf->ref and the per-data-block ref_count. Under true concurrency, two independent unrefs can observe the same prior value and both tre...
EUVD-2026-40367
The Zephyr netbuf library lib/netbuf/buf.c manipulated both of its reference counts -- the per-header buf-ref and the per-data-block refcount at the start of each variable/heap data allocation -- with plain non-atomic C operators buf-ref++, if --buf-ref 0, if --refcount. The API is documented as...
CVE-2026-10653 Non-atomic `net_buf` reference counts cause double-free / free-list corruption under concurrent unref
The Zephyr netbuf library lib/netbuf/buf.c manipulated both of its reference counts -- the per-header buf-ref and the per-data-block refcount at the start of each variable/heap data allocation -- with plain non-atomic C operators buf-ref++, if --buf-ref 0, if --refcount. The API is documented as...
CVE-2026-49451
The OpenAPI.NET SDK contains a useful object model for OpenAPI documents in .NET along with common serializers to extract raw OpenAPI JSON and YAML documents from the model. From 2.0.0-preview11 until 2.7.5 and 3.5.4, a small OpenAPI document containing a circular schema reference can cause proce...
CVE-2026-49451
The issue affects the OpenAPI.NET SDK used for OpenAPI document parsing in .NET. A circular schema reference in a small OpenAPI document can cause process termination via stack overflow when using public OpenAPI.NET reader APIs, applicable to both JSON and YAML paths. Affected versions range from...
WordPress Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Optimizer Data Deletion/Read/Modification vulnerability
Insecure Direct Object Reference to Authenticated Contributor+ Arbitrary Optimizer Data Deletion/Read/Modification vulnerability discovered by se1en in WordPress Plugin Gutenberg Blocks by Kadence Blocks versions = 3.7.7...
Exploit for Authorization Bypass Through User-Controlled Key in Langflow
CVE-2026-55255 - Langflow IDOR in /api/v1/responses Exec...
CVE-2026-27883 Coolify: IDOR in Deployment API - Cross-Team Deployment Information Disclosure
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the GET /api/v1/deployments/uuid endpoint allows any authenticated user to access deployment details belonging to any team, bypassing team-based authorization. The $teamId ...
MINI-F868-8FFW-CJ24
Bulletin has no description...
MINI-JPQP-HXR7-3RRC
Bulletin has no description...
MINI-FPGV-WVVV-44XH
Bulletin has no description...
MINI-PX4P-6H96-7797
Bulletin has no description...
MINI-RFGR-8HWP-376M
Bulletin has no description...
MINI-QFPP-73GP-2MPX
Bulletin has no description...
MINI-4XWQ-F47R-45H9
Bulletin has no description...
MINI-JMMM-MFGR-HR5J
Bulletin has no description...