3860 matches found
CVE-2026-56830 Shopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorization
Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store in packages/admin/src/Livewire/Components/Products/Form/Media.php without the editproducts authorization check used by sibling sub-forms. An authenticated staff user with...
CVE-2026-56830
Shopper (Headless e-commerce Admin Panel) is affected by a missing authorization check in the Media sub-form (packages/admin/src/Livewire/Components/Products/Form/Media.php). The store() method lacked the authorize('edit_products') call that was added to five sibling sub-forms (Edit, Inventory, S...
EUVD-2026-78920
Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store in packages/admin/src/Livewire/Components/Products/Form/Media.php without the editproducts authorization check used by sibling sub-forms. An authenticated staff user with...
CVE-2026-56830 Shopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorization
Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store in packages/admin/src/Livewire/Components/Products/Form/Media.php without the editproducts authorization check used by sibling sub-forms. An authenticated staff user with...
CVE-2026-56830 Shopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorization
Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store in packages/admin/src/Livewire/Components/Products/Form/Media.php without the editproducts authorization check used by sibling sub-forms. An authenticated staff user with...
AZL-103062 CVE-2026-79699 affecting package buildah 1.43.1-3
A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header e.g. victim/.wh. can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or...
AZL-103089 CVE-2026-79699 affecting package podman 5.6.1-10
A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header e.g. victim/.wh. can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or...
AZL-103227 CVE-2026-79699 affecting package libcontainers-common 20240213-3
A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header e.g. victim/.wh. can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or...
AZL-103269 CVE-2026-79699 affecting package skopeo 1.14.4-13
A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header e.g. victim/.wh. can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or...
DEBIAN-CVE-2026-79699
A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header e.g. victim/.wh. can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or...
AZL-103071 CVE-2026-79699 affecting package cri-o 1.30.1-1
A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header e.g. victim/.wh. can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or...
CVE-2026-79699
A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header e.g. victim/.wh. can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or...
CVE-2026-58200 @jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter Signing
Payload Plugins is a collection of plugins designed to enhance Payload CMS. From 0.3.0 until 0.4.0, @jhb.software/payload-cloudinary-plugin deployments with clientUploads enabled expose POST /api/cloudinary-generate-signature, whose handler in cloudinary/src/getGenerateSignature.ts passes...
CVE-2026-58200
@jhb.software/payload-cloudinary-plugin (Payload CMS Cloudinary storage adapter), versions 0.3.0 through 0.4.0 , is affected by an Improper Verification of Cryptographic Signature (CWE-347) when clientUploads: true is enabled. The POST /api/cloudinary-generate-signature endpoint in cloudinary/src...
CVE-2026-58200 @jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter Signing
Payload Plugins is a collection of plugins designed to enhance Payload CMS. From 0.3.0 until 0.4.0, @jhb.software/payload-cloudinary-plugin deployments with clientUploads enabled expose POST /api/cloudinary-generate-signature, whose handler in cloudinary/src/getGenerateSignature.ts passes...
CVE-2026-79699 Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory
A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header e.g. victim/.wh. can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or...
EUVD-2026-78824
A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header e.g. victim/.wh. can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or...
CVE-2026-79699 Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory
A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header e.g. victim/.wh. can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or...
CVE-2026-79699
A flaw in the containers/storage library (used by Podman , buildah , and skopeo ) allows a crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) to replace the extraction destination directory with an arbitrary file when processed by UnpackLayer, ApplyLayer, or ApplyUncomp...
CVE-2026-79699
A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header e.g. victim/.wh. can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or...