23534 matches found
Vite - Arbitrary File Read
Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. @fs denies access to files outside of Vite serving allow list. Adding ?raw?? or ?import&raw?? to the URL bypasses this limitation and returns the file content if it...
EUVD-2026-54719
Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, autorestore.kak script can be exploited by malicious backup files leading to arbitrary kakoune and shell commands being executed by simply opening a file. Kakoune 2026.05.21 fixes the issue. As a workaround, a...
EUVD-2026-54654
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.3, the Companion app treats tag links NFC or QR delivered through an OS-level routing mechanism as if they were physically scanned, without validating the calling app or prompting the user...
CVE-2026-47660 Pathling: Explicit oauthMetadataUrl in bulk-submit allows OAuth client credential exfiltration
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's bulk-submit operation allows an allowed submitter to supply an explicit oauthMetadataUrl parameter that is not validated against...
CVE-2026-71849 Hono: Proxy Helper does not remove response headers listed in the `Connection` header
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.7.0 to 4.12.33, the Proxy Helper proxy function in hono/proxy does not remove response headers named by the origin's Connection header. Per RFC 9110 Section 7.6.1, an intermediary must remove the header...
CVE-2026-71557
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name for example containing...
CVE-2026-71557 go-git: Malicious reference names may modify files outside the reference storage
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name for example containing...
CVE-2026-71557 go-git: Malicious reference names may modify files outside the reference storage
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name for example containing...
CVE-2026-17595
Nexus Repository 3 is affected by a JEXL Content Selector sandbox bypass where an account with nexus:selectors:create could read Java object properties not intended for exposure, potentially revealing internal JVM class metadata (e.g., class and classloader names). The issue stems from incomplete...
CVE-2026-66059 Frappe: Field-level permission bypass via Document Follow
Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, a field-level permissions bypass exposes restricted DocType fields. This issue is fixed in versions 16.23.0 and 15.112.0...
ROOT-APP-PYPI-CVE-2024-28219 CVE-2024-28219 in pillow - Patched by Root
Root has patched CVE-2024-28219 in the pillow package for Root:PyPI. Multiple fixed versions available...
RHSA-2026:51277 Red Hat Security Advisory: systemd security, bug fix, and enhancement update
Bulletin has no description...
ROOT-APP-NPM-CVE-2026-44574 CVE-2026-44574 in next - Patched by Root
Root has patched CVE-2026-44574 in the next package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2022-23540 CVE-2022-23540 in jsonwebtoken - Patched by Root
Root has patched CVE-2022-23540 in the jsonwebtoken package for Root:npm. Multiple fixed versions available...
ROOT-OS-DEBIAN-13-CVE-2025-71077 CVE-2025-71077 in linux - Patched by Root
Root has patched CVE-2025-71077 in the linux package for Root:Debian:13. Multiple fixed versions available...
ROOT-OS-DEBIAN-13-CVE-2025-38660 CVE-2025-38660 in linux - Patched by Root
Root has patched CVE-2025-38660 in the linux package for Root:Debian:13. Multiple fixed versions available...
ROOT-OS-DEBIAN-13-CVE-2025-40064 CVE-2025-40064 in linux - Patched by Root
Root has patched CVE-2025-40064 in the linux package for Root:Debian:13. Multiple fixed versions available...
ROOT-OS-DEBIAN-13-CVE-2025-39841 CVE-2025-39841 in linux - Patched by Root
Root has patched CVE-2025-39841 in the linux package for Root:Debian:13. Multiple fixed versions available...