260029 matches found
EUVD-2026-48580
Parse Server versions = 9.0.0 before 9.10.0-alpha.6 and = 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled graphQLPublicIntrospection: false, the default. Because these...
EUVD-2026-48551
Local privilege escalation potentially allowed an attacker to write an arbitrary file with fully controlled content as a privileged user...
CVE-2026-63317
Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP Versions Affected: - before 2.5.10 - before 3.0.0-M5 Description: Three code paths in Apache OpenNLP load a class by its fully-qualified name via Class.forName and invoke its no-arg constructor...
CVE-2026-12702
In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deployment...
EUVD-2026-48531
In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deployment...
GHSA-WC96-39FC-566F vulnerabilities
Vulnerabilities for packages: pinot-fips, tez, apache-hop-fips, apache-hop, pinot, thingsboard...
GHSA-G7HG-VRCF-MVMR vulnerabilities
Vulnerabilities for packages: pinot-fips, tez, apache-hop-fips, apache-hop, pinot, thingsboard...
GHSA-272M-GCWP-MPWG vulnerabilities
Vulnerabilities for packages: pinot-fips, tez, apache-hop-fips, apache-hop, pinot, thingsboard...
GHSA-JPPX-W49H-X2QQ vulnerabilities
Vulnerabilities for packages: apache-pulsar, floci, flyway-fips, keycloak, flyway, hono, floci-az, infinispan, s3proxy-fips, cloudwatch-exporter, apicurio-registry, knative-kafka-broker, apache-nifi, knative-kafka-broker-fips, kayenta, request-9047-keycloak-fips, s3proxy, kayenta-fips,...
CVE-2026-56820 vulnerabilities
Vulnerabilities for packages: tez, thingsboard...
CVE-2026-56745 vulnerabilities
Vulnerabilities for packages: flyway, cloudwatch-exporter, infinispan, apicurio-registry, apache-nifi...
CVE-2026-55833 vulnerabilities
Vulnerabilities for packages: flyway, cloudwatch-exporter, infinispan, apicurio-registry, apache-nifi...
CVE-2026-56392
GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop -t values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer. When processing crafted...
CVE-2026-11922
The CVE-2026-11922 entry describes a rate-limit bypass in zenml-io/zenml (versions 0.57.0–0.94.2). The issue arises because the rate limiter uses request.client.host (derived from the X-Forwarded-For header when Uvicorn is run with --proxy-headers --forwarded-allow-ips *), allowing an attacker to...
OESA-2026-3142 tomcat security update
Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Security Fixes: Improper Handling of URL Encodi...
OESA-2026-3133 jbig2dec security update
jbig2dec is a decoder implementation of the JBIG2 image compression format. Security Fixes: An integer overflow in the jbig2arithiaidctxnew function of Artifex commit cc37d0 allows attackers to cause a Denial of Service DoS via a crafted input.CVE-2026-38076...
OESA-2026-3130 389-ds-base security update
389-ds-base is an LDAPv3 compliant server which includes the LDAP server and command line utilities for server administration. Security Fixes: A flaw was found in 389-ds-base. The getldapmessagecontrolsext function in the LDAP server does not enforce an upper bound on the number of controls per...
OESA-2026-3115 pipewire security update
is a server and user space API to deal with multimedia pipelines,contains command line utilities. Security Fixes: RAOP module accepts unbounded Content-Length values and does not check the pwarrayadd return.CVE-2026-14324...
