262017 matches found
CVE-2026-8446
creationtimestamp| type| source ---|---|--- 2026-08-05 18:00:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mse4aow6hz2l...
DRUPAL-CONTRIB-2026-093
This module provides formatters to allow in-place editing in a View or other display full content, teaser.... The module doesn't sufficiently check access when editing entities. A malicious user could craft requests to allow them to modify any field on any entity. This vulnerability is mitigated ...
@ascua/electron (>=0.8.0, <=0.18.0), @eltmon/panctl (0.7.2-canary.3) +11 more potentially affected by CVE-2026-70610 via electron (>=40.0.0, <=40.8.5)
electron NPM version =40.0.0, =0.8.0, =4.0.0, =0.30.0, =0.8.0, =1.1.0-rc-1, =1.0.0, =1.142.0, =0.1.5, =1.2.1, =2.0.4, =3.24.1 Source cves: CVE-2026-70610 Source advisory: SNYK:JS-ELECTRON-18563332...
CVE-2026-70446
CVE-2026-70446 affects Jenkins CodeSonar Plugin up to version 3.6.0. The root cause is missing permission checks on HTTP endpoints, allowing users with Overall/Read to enumerate the IDs of credentials stored in Jenkins. The advisory notes that these credentials IDs could be used in conjunction wi...
CVE-2026-70429
Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attackers able to create new users or groups with names that case-insensitively match other characters to impersonate other users or be granted their permissions in...
CVE-2026-17626
IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow an authenticated attacker to read, modify, or expose sensitive host files via Docker-based MCP servers due to incomplete filtering of dangerous Docker volume-mount and device-mapping arguments...
CVE-2026-9190
creationtimestamp| type| source ---|---|--- 2026-08-05 17:16:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msdzqmqsvx2l 2026-08-06 16:15:49+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/progress-security-advisory-av26-781...
CVE-2026-20267
creationtimestamp| type| source ---|---|--- 2026-08-05 17:07:01+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3msdzafb4i22n 2026-08-05 17:20:16+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msdzxrqzrr2l 2026-08-06 05:17:05+00:00| seen|...
CVE-2026-20304
creationtimestamp| type| source ---|---|--- 2026-08-05 16:51:36+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3msdyet7jwc24 2026-08-05 17:22:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mse23e2oxs2p 2026-08-06 03:17:09+00:00| seen|...
CVE-2026-9077
Summary of CVE-2026-9077 (IBM Langflow OSS) : Langflow OSS versions 1.0.0–1.10.3 allow remote authenticated attackers to bypass localhost-only restrictions and write arbitrary MCP server configurations to IDE configuration files on the host. The vulnerability stems from weaknesses in MCP command/...
CVE-2026-70607 Electron: window.open features string controls some window options considered privileged
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, some window options supplied by web content in the window.open features string were applied to the new BrowserWindow without an allowlist...
CVE-2026-16442
A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with contr...
ROOT-APP-PYPI-CVE-2026-28684 CVE-2026-28684 in python-dotenv - Patched by Root
Root has patched CVE-2026-28684 in the python-dotenv package for Root:PyPI. Multiple fixed versions available...
CVE-2026-69088
creationtimestamp| type| source ---|---|--- 2026-08-05 16:00:04+00:00| published-proof-of-concept| https://t.me/bdufstecru/3364 2026-08-06 00:00:34+00:00| published-proof-of-concept| https://t.me/bdufstecru/3364...
ROOT-APP-PYPI-CVE-2024-22195 CVE-2024-22195 in Jinja2 - Patched by Root
Root has patched CVE-2024-22195 in the Jinja2 package for Root:PyPI. Multiple fixed versions available...
CVE-2026-9192 Authentication bypass in Progress MarkLogic Server ODBC App Server
An authentication bypass vulnerability in the ODBC App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass password verification and execute queries with the privileges of any named user known to the server, including administrators...
CVE-2026-48912
creationtimestamp| type| source ---|---|--- 2026-08-05 15:31:09+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/igyfohm5byanp...
@ascua/electron (>=0.8.0, <=0.18.0), @eltmon/panctl (0.7.2-canary.3) +11 more potentially affected by CVE-2026-70597 via electron (>=40.0.0, <=40.8.5)
electron NPM version =40.0.0, =0.8.0, =4.0.0, =0.30.0, =0.8.0, =1.1.0-rc-1, =1.0.0, =1.142.0, =0.1.5, =1.2.1, =2.0.4, =3.24.1 Source cves: CVE-2026-70597 Source advisory: SNYK:JS-ELECTRON-18563340...
CVE-2026-15572 Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation
A flaw was found in Keycloak's Dynamic Client Registration DCR security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a client update if the mapper's configuration remains...