18283 matches found
github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API
A flaw was found in Prometheus, an open-source monitoring system. The clientsecret field within the Azure Active Directory AD remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access t...
CVE-2026-52203
creationtimestamp| type| source ---|---|--- 2026-07-16 08:34:05+00:00| seen| https://gist.github.com/this1slwl/1bfb6996ca7edf6f5d15b5ebc181f337...
ROOT-APP-NPM-CVE-2026-49465 CVE-2026-49465 in @rootio/n8n - Patched by Root
Root has patched CVE-2026-49465 in the @rootio/n8n package for Root:npm. Multiple fixed versions available...
CVE-2026-15907 H3C SecPath F1000-C8300 g=log_fw_nbc_mail_jsondata sql injection
A flaw has been found in H3C SecPath F1000-C8300 up to 20260522. This impacts an unknown function of the file /webui/?g=logfwnbcmailjsondata. Executing a manipulation of the argument subject can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be...
decompress: @xhmikosr/decompress: Decompress: Arbitrary file read/write via crafted archive extraction
A flaw was found in the decompress package for Node.js. A remote attacker can exploit this vulnerability by crafting a malicious archive. When the archive is extracted, it can create files and links outside the intended directory, leading to unauthorized reading or writing of files. This is due t...
CVE-2023-54365 vulnerabilities
Vulnerabilities for packages: kubeflow-katib...
CVE-2026-13030
An uninitialized use flaw was found in the GPU component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=522840723...
UBUNTU-CVE-2026-15779
A flaw was found in samba's pamwinbind. When mkhomedir is enabled, pamwinbind chowns the target account's home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as their home directory a common default for system accounts can...
golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...
ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm
A flaw was found in ASP.NET Core. An authorized attacker can exploit an incorrect implementation of the authentication algorithm over a network. This vulnerability allows the attacker to elevate their privileges, potentially gaining unauthorized access to sensitive resources or performing actions...
CVE-2026-15749 mastergo-design mastergo-magic-mcp mcp__C2d get-c2d.ts execute path traversal
A security flaw has been discovered in mastergo-design mastergo-magic-mcp up to 0.2.0. This issue affects the function execute of the file src/tools/get-c2d.ts of the component mcpC2d. Performing a manipulation of the argument filePath results in path traversal. The attack requires a local...
CVE-2026-50335
Improper access control in Windows Operating Systems allows an authorized attacker to elevate privileges locally...
CVE-2026-62656
The CVE-2026-62656 entry concerns post-authenticated command injection affecting certain NETGEAR RAX models. A logged-in user can send specially crafted requests to the router to run unauthorized commands, enabling changes to the router and impacting security/operation. The vulnerability targets ...
CVE-2026-57108 .NET Denial of Service Vulnerability
...
CVE-2026-50657 Microsoft Defender for Endpoint for Mac Information Disclosure Vulnerability
...
CVE-2026-50435 Windows Overlay Filter Elevation of Privilege Vulnerability
...
CVE-2026-50365
CVE-2026-50365 describes an Elevation of Privileges in the Windows RPC API (RPC server) due to improper authentication, enabling an adjacent-network attacker to gain high-priority access. Public data confirms an adjacent-network attack vector with high severity (CVSS ~8.0). The affected component...
CVE-2026-50323 Windows Runtime Elevation of Privilege Vulnerability
...