262267 matches found
CVE-2026-47865
VMware Avi Load Balancer contains an authentication bypass vulnerability. A malicious user with network access may be able to access the Avi Control plane by bypassing the authentication mechanism. Affected versions: 31.1.1 through 31.2.2 fixed in 31.2.2-2p3 30.1.1 through 30.2.6 fixed in 30.2.7...
CVE-2026-16083
A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. This affects the function webhook.ParseRequest of the file pkg/channels/line/line.go of the component LINE Webhook. The manipulation results in authentication bypass by capture-replay. The attack may be launched remotely. The...
CVE-2026-16085 Sipeed PicoClaw context.go NewContextBuilder inclusion of functionality from untrusted control sphere
A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. Affected is the function NewContextBuilder of the file pkg/agent/context.go. Such manipulation leads to inclusion of functionality from untrusted control sphere. The attack needs to be performed locally. The exploit has be...
CVE-2026-13445
creationtimestamp| type| source ---|---|--- 2026-07-18 09:00:54+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqvvokzq3x2c 2026-07-21 17:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mr6dwfosuq2y...
CVE-2026-47871 VMware Avi Load Balancer Directory Traversal Vulnerability
VMware Avi Load Balancer contains a directory traversal vulnerability. Flaws in file path validation allow malicious, authenticated network users to perform directory traversal attacks. Affected versions: 32.1.1 fixed in 32.1.2 31.1.1 through 31.2.2 fixed in 31.2.2-2p3 30.1.1 through 30.2.6 fixed...
CVE-2026-47870
CVE-2026-47870 affects VMware Avi Load Balancer. A malicious authenticated user with network access can potentially execute remote code due to a privilege-escalation flaw. Affected versions and fixes shown in public records: 32.1.1 (fixed in 32.1.2); 31.1.1–31.2.2 (fixed in 31.2.2-2p3); 30.1.1–30...
CVE-2026-38755
creationtimestamp| type| source ---|---|--- 2026-07-18 08:01:42+00:00| seen| https://bsky.app/profile/bootintel.bsky.social/post/3mqvsepxqy52s...
MGASA-2026-0260 Updated python-pydantic-settings packages fix a security vulnerability
The updated packages fix a security vulnerability: NestedSecretsSettingsSource follows symlinks outside secretsdir, enabling local file read and bypassing secretsdirmaxsize. CVE-2026-58203...
Exploit for CVE-2026-63030
No d...
EUVD-2026-45344
Authentication bypass using an alternate path or channel in Microsoft Edge Chromium-based allows an unauthorized attacker to perform tampering over a network...
PT-2026-60961
Name of the Vulnerable Software and Affected Versions @fastify/http-proxy versions prior to 11.6.0 Description An improper input normalization issue exists where the software fails to rewrite the request prefix when the prefix segment is URL-encoded. While the router URL-decodes paths for route...
Linux Distros Unpatched Vulnerability : CVE-2026-15900
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in GPU in Google Chrome on Android prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML...
CVE-2026-44979
@hapi/wreck is an HTTP client utility. Prior to 18.1.1, when @hapi/wreck follows a 3xx redirect to a different hostname, only the Authorization and Cookie headers are stripped, and the standard credential header Proxy-Authorization is forwarded intact to the redirect target, potentially exposing...
CVE-2026-13473
creationtimestamp| type| source ---|---|--- 2026-07-17 21:54:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mquqgymxyv24 2026-07-18 18:01:23+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqwtv254kw2g...
CVE-2026-48062
CodeIgniter is a PHP full-stack web framework. Prior to 4.7.3, the extin upload validation rule in system/Validation/StrictRules/FileRules.php checked the MIME-derived guessed extension instead of the client-provided filename extension. As a result, an uploaded file named shell.php containing...
CVE-2026-53727
cssparser is a Ruby CSS parser. From 2.2.0 until 3.0.0, CssParser::Parserreadremotefile in lib/cssparser/parser.rb, and therefore loaduri! and the @import-following branch of addblock!, issued HTTP and HTTPS requests against any host, port, and URI without a scheme allowlist, host or IP filtering...
CVE-2026-49485 HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.9 and 6.9.4.2, all implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation, and the FHIRPath functions matches,...
CVE-2026-54335 Feathersjs: Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In 5.0.44 and earlier, the .mergetarget, source utility exported by @feathersjs/commons recursively merges source into target by iterating Object.keyssource. When source was produced by...
CVE-2026-54498
viewcomponent is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 4.0.0 until 4.12.0, ViewComponent::Basearoundrender can return HTML-unsafe strings that bypass the escaping behavior applied to normal call return values. This creates an XSS risk...