3096758 matches found
CVE-2026-19908
CVE-2026-19908 affects the PAX Technology Q80 XCB Daemon. The flaw arises from a lack of authentication before accessing daemon functionality, allowing network-adjacent attackers to disclose sensitive information and modify configurations. The description also notes potential to execute arbitrary...
CVE-2026-19909
PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability. The specific flaw...
CVE-2026-19909 PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vulnerability
PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability. The specific flaw...
EUVD-2026-58800
PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability. The specific flaw...
CVE-2026-19909 PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vulnerability
PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability. The specific flaw...
CVE-2026-19909
Technical details beyond the initial description are not publicly available in the provided connected documents. No concrete information on affected products/versions, root cause specifics, impact scope, or remediation is present. Monitor for updates.
ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)
Summary The /admin/gateways/test endpoint validates submitted URLs by resolving the hostname at validation time and blocking private address ranges. The HTTP client independently re-resolves DNS at connection time with no IP binding between the two operations, creating a TOCTOU window exploitable...
GHSA-9HGC-G3W5-67CM ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)
Summary The /admin/gateways/test endpoint validates submitted URLs by resolving the hostname at validation time and blocking private address ranges. The HTTP client independently re-resolves DNS at connection time with no IP binding between the two operations, creating a TOCTOU window exploitable...
MAL-2026-14047 Malicious code in @guangnao/agent-proxy (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8da2cb00fa6d2b5a0e5f4a4bdca8ca0cfaedf7e583b0f9e9f54274bcf5c39e06 On invocation of agent-proxy start, the CLI opens an outbound WebSocket to an obfuscated author-controlled endpoint hub.client-llm.com, reconstructed...
Malicious code in @guangnao/agent-proxy (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8da2cb00fa6d2b5a0e5f4a4bdca8ca0cfaedf7e583b0f9e9f54274bcf5c39e06 On invocation of agent-proxy start, the CLI opens an outbound WebSocket to an obfuscated author-controlled endpoint hub.client-llm.com, reconstructed...
CVE-2026-72552
A flaw was found in Dub. This server-side request forgery SSRF vulnerability allows an unauthenticated remote attacker to force the server to make HTTP requests to arbitrary internal or external hosts. This can be exploited via the metatags edge endpoint, which processes caller-supplied URLs...
GHSA-H84G-69H7-MW6V mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"
Impact Prior to version 0.6.0, mchange-commons-java includes a JNDI ObjectFactory implementation com.mchange.v2.naming.JavaBeanObjectFactory willing to construct objects of arbitrary classes and initialize "JavaBean"-style properties. There are classes for which this kind of initialization is...
mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"
Impact Prior to version 0.6.0, mchange-commons-java includes a JNDI ObjectFactory implementation com.mchange.v2.naming.JavaBeanObjectFactory willing to construct objects of arbitrary classes and initialize "JavaBean"-style properties. There are classes for which this kind of initialization is...
Sensitive Cookie with Improper SameSite Attribute
Overview Affected versions of this package are vulnerable to Sensitive Cookie with Improper SameSite Attribute through the server default configuration and OAuth2/OIDC consent flow in serverdefaults.properties, ConsentRequiredResource, and CsrfProtection. An attacker can steal or abuse an...
CVE-2026-18554 IBM Db2 Mirror for i is affected by multiple vulnerabilities
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory...
CVE-2026-18554
IBM Db2 Mirror for i (versions 7.4, 7.5, 7.6) is affected by CVE-2026-18554 due to improper limitation of a pathname to a restricted directory, enabling a remote authenticated attacker to obtain sensitive information. This is one of several vulnerabilities listed in IBM’s security bulletin for th...
CVE-2026-18554
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory...
EUVD-2026-58770
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory...
CVE-2026-18554 IBM Db2 Mirror for i is affected by multiple vulnerabilities
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory...