91209 matches found
CVE-2026-58425: Exposure of Sensitive Information to an Unauthorized Actor
OAuth token introspection returns metadata of tokens issued to other clients RFC 7662 section 4 violation...
CVE-2026-56443: Incorrect Authorization
Token public-only scope bypassed on Limited-visibility owners Repository + Package categories — residual after CVE-2026-25714 / PR 37118...
CVE-2026-55986: Improper Access Control
Email Management API Bypasses ManageCredentials Feature Restrictions...
CVE-2026-42931: Allocation of Resources Without Limits or Throttling
Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint...
CVE-2026-17223: Out-of-bounds Write
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to a buffer overflow...
CVE-2026-17206: Out-of-bounds Write
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to a buffer overflow...
CVE-2026-17069: Cross-Site Request Forgery (CSRF)
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of anti-CSRF tokens...
CVE-2026-16929: Out-of-bounds Write
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a buffer overflow...
CVE-2026-16859: Out-of-bounds Read
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read...
CVE-2026-16853: Out-of-bounds Read
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read...
CVE-2026-16674: Untrusted Search Path
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an untrusted search path...
CVE-2026-28159: Missing Authorization
Subscriber Broken Access Control in Service Finder Booking = 6.2 versions...
CVE-2026-28002: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22...
CVE-2026-27539: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Welcart e-Commerce = 2.11.31 versions...
CVE-2026-27535: Missing Authorization
Subscriber Broken Access Control in Solace Extra = 1.6.0 versions...
CVE-2026-27345: Missing Authorization
Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce = 2.0.3 versions...
CVE-2026-28157: Path Traversal: '.../...//'
Subscriber Path Traversal in Do Lasso = 358 versions...
CVE-2026-28156: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in Do Lasso = 358 versions...