23282 matches found
CVE-2026-55550
NextCRM is open-source customer relationship management CRM software. The CRM product catalog is an organization-wide business object. Normal application server actions restrict product creation, update, and deletion to manager and admin roles. However, in version 0.12.1, the MCP product tools...
EUVD-2026-44707
File Browser: Archive builder turns backslash filenames into path traversal zip-slip...
EUVD-2026-42363
Composer: URL-embedded HTTP-Basic username leaks to verbose logs GitHub PAT exposure...
EUVD-2026-42303
node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records...
EUVD-2026-44670
LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests...
CVE-2026-55550
NextCRM is open-source customer relationship management CRM software. The CRM product catalog is an organization-wide business object. Normal application server actions restrict product creation, update, and deletion to manager and admin roles. However, in version 0.12.1, the MCP product tools...
CVE-2026-56623 Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git on Windows
Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and server-side SSH. A git server implemented with Apache MINA SSHD component sshd-git and running on Windows could allow an authenticated remote user access to git repositories...
CVE-2026-44230 RT: Reflected Cross-Site Scripting in search results chart
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.4 up to but not including 5.0.10, and 6.0.0 up to but not including 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability where an attacker who can induce an authenticated RT user to visit a crafted U...
EUVD-2026-41925
vLLM denial of service via prompt embeds on M-RoPE models...
MGASA-2026-0277 Updated xmlstarlet package fixes a security vulnerability
The updated package fixes a security vulnerability: XML external entity vulnerability. References: https://lists.fedoraproject.org/archives/list/[email protected] oraproject.org/message/KDR5XRMVBCDZ4HWDCGLKDVKGSCWACG33/...
CVE-2026-58413
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, EnvironmentManager.restoreenv, backupId computes the backup path with joinenvDir, '.backups', backupId and only checks that this path exists. It does not resolve the result or verify that it remains under...
CVE-2026-58481 Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, AgentRuntime promises scoped file access under a configured sandbox basePath, but its path containment checks use raw string prefix tests. A sandbox base such as /tmp/network-ai-sandbox also matches a sibling pa...
Important: Red Hat Security Advisory: Satellite 6.16.11 Async Update
An update is now available for Red Hat Satellite 6.16 for RHEL 8 and RHEL 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...
SUSE-SU-2026:22800-1 Security update for containerd
This update for containerd fixes the following issues - CVE-2026-35469: github.com/moby/spdystream: memory amplification in SPDY frame parsing leads to denial of service bsc1262266...
ROOT-OS-DEBIAN-13-CVE-2026-49295 CVE-2026-49295 in rootio-libde265 - Patched by Root
Root has patched CVE-2026-49295 in the rootio-libde265 package for Root:Debian:13. Multiple fixed versions available...
CVE-2026-64066
In the Linux kernel, the following vulnerability has been resolved: n...
CVE-2026-64052
In the Linux kernel, the following vulnerability has been resolved: b...
CVE-2026-53367
In the Linux kernel, the following vulnerability has been resolved: s...
PT-2026-61667
Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.221 Description An unauthenticated remote attacker can download attachments created by older versions of the software. This occurs because the attachment download route skips token authentication when the token...