262277 matches found
CVE-2026-12799
creationtimestamp| type| source ---|---|--- 2026-06-21 14:05:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mosk3xudm42t...
CVE-2026-12779
creationtimestamp| type| source ---|---|--- 2026-06-21 13:30:29+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mosi5rjyhv2m 2026-06-21 13:30:39+00:00| seen| https://infosec.exchange/users/offseq/statuses/116788338824907237 2026-06-22 12:39:57+00:00| seen|...
CVE-2026-56384 Craft CMS - Missing Authorization in assets/preview-thumb Endpoint
Craft CMS contains a missing authorization vulnerability in the assets/preview-thumb endpoint. A Control Panel user without permission to view a target private asset can call the endpoint with an attacker-controlled assetId and receive preview HTML containing a signed fallback transform preview...
CVE-2025-71348
picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils.configmodule.loadconfig function within reduce methods. Attackers can craft pickle files embedding arbitrary code that evades detection but executes during pickle.load, enabling remote code execution in supply...
CVE-2026-12799 BerriAI litellm Incomplete Fix CVE-2025-0628 internal_user_endpoints.py ui_view_users improper authorization
A security vulnerability has been detected in BerriAI litellm up to 1.82.2. Affected by this issue is the function uiviewusers of the file litellm/proxy/managementendpoints/internaluserendpoints.py of the component Incomplete Fix CVE-2025-0628. Such manipulation leads to improper authorization. I...
EUVD-2026-38158
A security vulnerability has been detected in BerriAI litellm up to 1.82.2. Affected by this issue is the function uiviewusers of the file litellm/proxy/managementendpoints/internaluserendpoints.py of the component Incomplete Fix CVE-2025-0628. Such manipulation leads to improper authorization. I...
CVE-2026-12799 BerriAI litellm Incomplete Fix CVE-2025-0628 internal_user_endpoints.py ui_view_users improper authorization
A security vulnerability has been detected in BerriAI litellm up to 1.82.2. Affected by this issue is the function uiviewusers of the file litellm/proxy/managementendpoints/internaluserendpoints.py of the component Incomplete Fix CVE-2025-0628. Such manipulation leads to improper authorization. I...
CVE-2026-12798 BerriAI litellm MCP OpenAPI Spec Loader openapi_to_mcp_generator.py load_openapi_spec_async server-side request forgery
A weakness has been identified in BerriAI litellm up to 1.82.2. Affected by this vulnerability is the function loadopenapispecasync of the file litellm/proxy/experimental/mcpserver/openapitomcpgenerator.py of the component MCP OpenAPI Spec Loader. This manipulation of the argument specpath causes...
CVE-2026-12798
CVE-2026-12798 affects BerriAI litellm up to 1.82.2, specifically the MCP OpenAPI Spec Loader’s load_openapi_spec_async function. The root cause is manipulation of the spec_path argument allowing server-side request forgery, which can be triggered remotely. The description notes that the exploit ...
CVE-2026-12797
Technical details about CVE-2026-12797 are not publicly available in the provided documents. Monitor for updates from official advisories and vendor notices to obtain affected products, vulnerable components, and remediation information.
CVE-2026-12796 BerriAI litellm SSO Authentication Flow ui_sso.py get_redirect_response_from_openid session expiration
A vulnerability was identified in BerriAI litellm up to 1.82.2. This impacts the function getredirectresponsefromopenid of the file litellm/proxy/managementendpoints/uisso.py of the component SSO Authentication Flow. The manipulation leads to session expiration. The attack is possible to be carri...
CVE-2026-12778
creationtimestamp| type| source ---|---|--- 2026-06-21 08:12:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3morwedwvx32x 2026-06-22 12:39:57+00:00| seen| https://www.acn.gov.it/portale/w/aomei-disponibili-poc-pubblici-per-le-cve-2026-12778-cve-2026-12779-e-cve-2026-12780...
CVE-2026-12771
creationtimestamp| type| source ---|---|--- 2026-06-21 03:54:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3morhy6ygjl2f...
GHSA-H8W8-99G7-QMVJ vulnerabilities
Vulnerabilities for packages: ruby3.4-fluentd-kubernetes-daemonset, kube-logging-operator, ruby4.0-fluentd-kubernetes-daemonset, ruby3.4-rails, ruby3.2-rails, ruby3.2-fluentd-kubernetes-daemonset, ruby3.3-fluentd-kubernetes-daemonset, kube-fluentd-operator, logstash...
GHSA-WV3X-4VXV-WHPP vulnerabilities
Vulnerabilities for packages: ruby3.4-fluentd-kubernetes-daemonset, kube-logging-operator, ruby4.0-fluentd-kubernetes-daemonset, ruby3.4-rails, ruby3.2-rails, ruby3.2-fluentd-kubernetes-daemonset, ruby3.3-fluentd-kubernetes-daemonset, kube-fluentd-operator, logstash...
PT-2026-51198
Name of the Vulnerable Software and Affected Versions BerriAI litellm versions prior to 1.82.3 Description An issue in the MCP Server Connection Testing component allows for server-side request forgery SSRF, which is a flaw that enables an attacker to induce the server-side application to make...
CVE-2026-56228
creationtimestamp| type| source ---|---|--- 2026-06-20 20:46:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moqq2ovth22l...
CVE-2026-56330
creationtimestamp| type| source ---|---|--- 2026-06-20 20:28:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moqp2fi5lq22 2026-06-21 13:11:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116788263084343961...
CVE-2026-56342
creationtimestamp| type| source ---|---|--- 2026-06-20 20:24:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moqoozz66m22...
CVE-2026-56345 AVideo - Arbitrary User Session Hijacking via Meet Plugin uploadRecordedVideo Endpoint
AVideo through 29.0 contains an authorization bypass vulnerability in the Meet plugin's uploadRecordedVideo.json.php endpoint that derives the target usersid from the uploaded filename without verification. An attacker with knowledge of the Meet shared secret can craft a malicious file upload wit...