90827 matches found
GO-2026-6346 Gitea pre-receive hook scanner errors allow branch-protection bypass in code.gitea.io/gitea
Gitea pre-receive hook scanner errors allow branch-protection bypass in code.gitea.io/gitea...
CVE-2026-81786: Missing Authorization
Unauthenticated Broken Access Control in Thank You Page Customizer for WooCommerce = 1.2.2 versions...
CVE-2026-81793: Missing Authorization
Missing Authorization vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salon booking system: from n/a through 10.31.9...
PT-2026-89611
Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.11.5 Description An authenticated attacker can execute arbitrary code because the security scanner uses an incomplete denylist. A denylist is a security mechanism that explicitly lists prohibited items...
CVE-2026-76059: Protection Mechanism Failure
IBM Langflow OSS 1.0.0 through 1.11.5 An attacker who could submit custom component source code could bypass the static security scanner by crafting an annotated class-body assignment that resolved to a dangerous callable through alias tracking; the resolved value was never checked against the...
CVE-2026-78569: Improper Neutralization of Special Elements used in an OS Command
IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to execute arbitrary code due to an incomplete denylist in the security scanner...
Security Updates for Microsoft Access Products C2R (September 2026)
The Microsoft Access Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. CVE-2026-69529, CVE-2026-69778 - Stack-based buffer overflow ...
CVE-2026-7188: Improper Neutralization of Special Elements used in an SQL Command
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Armiya Information Technologies Ltd. Co. Access Control System allows SQL Injection. This issue affects Access Control System: before Versiyon 2...
PT-2026-89286
A code execution vulnerability in Palo Alto Networks Checkov by Prisma® Cloud can allow arbitrary code execution when Checkov scans a directory that contains an attacker-controlled configuration file...
CVE-2026-88938: Improper Limitation of a Pathname to a Restricted Directory
knowns through 0.33.0 fails to confine the path argument of the code.find MCP tool to the project root, allowing AI agent sessions to read source files anywhere on the host. Attackers can supply absolute paths or relative traversal sequences to the path argument and retrieve full file contents fr...
CVE-2026-89087: Improper Following of Specification by Caller
The cstruct package before 6.3.0 for OCaml mishandles indexes...
CVE-2026-88899: External Control of File Name or Path
knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can supply arbitrary directory paths to execute file operations outside the project root on the host system...
CVE-2026-88939: Incorrect Authorization
knowns through 0.33.0 exempts the project.set action from permission guard checks unconditionally, allowing read-only agent sessions to bypass restrictions. Attackers can invoke project.set to repoint the server at another project directory and obtain write access capabilities...
CVE-2026-9166: Improper Limitation of a Pathname to a Restricted Directory
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in GIS Informatics GisLab Laboratory Management System allows Path Traversal. This issue affects GisLab Laboratory Management System: from 1.4.03 before 1.5...
CVE-2026-9163: Improper Neutralization of Special Elements used in an SQL Command
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in GIS Informatics GisLab Laboratory Management System allows SQL Injection. This issue affects GisLab Laboratory Management System: from 1.4.03 before 1.5...
CVE-2026-88940: Improper Limitation of a Pathname to a Restricted Directory
knowns through 0.33.0 fails to validate the path query parameter in the workspace browse endpoint, allowing remote attackers to enumerate arbitrary directories on the host filesystem. Attackers can traverse the directory structure to locate project directories and identify targets for further...
CVE-2026-66632: Improper Control of Generation of Code
Unauthenticated Content Injection in Simple Cloudflare Turnstile = 1.42.1 versions...
CVE-2026-71643: Uncontrolled Resource Consumption
An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a denial of service via the EGOReplanFSM component...