5361 matches found
PT-2026-70937
Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET /worker without authentication and serializes the complete live Task object, which can expose commands, environment variables,...
CVE-2026-11812 UpdateHub: race condition on shared context causes out-of-bounds write and DoS
The UpdateHub management subsystem subsys/mgmt/updatehub/updatehub.c drives every update operation through a single file-scope ctx structure that holds the CoAP block context, payload buffer, status code, socket, and a one-element poll-fd array fds1. Access to ctx was not serialized, and preparef...
CVE-2026-72735
Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traefik/application.ts serializes user-controlled Traefik configuration with yaml.stringify and interpolates the resulting yamlStr into an echo command executed...
CVE-2026-72735 Dokploy: Command injection in writeTraefikConfigRemote via shell interpolation of unescaped YAML in SSH remote execution
Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traefik/application.ts serializes user-controlled Traefik configuration with yaml.stringify and interpolates the resulting yamlStr into an echo command executed...
EUVD-2026-55681
Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traefik/application.ts serializes user-controlled Traefik configuration with yaml.stringify and interpolates the resulting yamlStr into an echo command executed...
CVE-2026-72735
Dokploy (PaaS) before v0.29.13 is affected by a command-injection in writeTraefikConfigRemote: user-controlled YAML is serialized via yaml.stringify and interpolated into an echo/exeсAsyncRemote command, where single quotes in redirect regex, authentication usernames, domain values, or middleware...
CVE-2026-72735
Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traefik/application.ts serializes user-controlled Traefik configuration with yaml.stringify and interpolates the resulting yamlStr into an echo command executed...
CVE-2026-72735 Dokploy: Command injection in writeTraefikConfigRemote via shell interpolation of unescaped YAML in SSH remote execution
Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traefik/application.ts serializes user-controlled Traefik configuration with yaml.stringify and interpolates the resulting yamlStr into an echo command executed...
CVE-2026-72723
CVE-2026-72723 (Discourse) : The issue affects Discourse versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. SiteSerializer.anonymous_default_navigation_menu_tags exposes tag names and descriptions for tags restricted by categories, category tag groups, or tag-group permissions to unaut...
CVE-2026-72723 Discourse: Anonymous sidebar serialization exposes descriptions of category-restricted tags
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, SiteSerializer.anonymousdefaultnavigationmenutags serializes tags from SiteSetting.defaultnavigationmenutags without applying DiscourseTagging.filtervisible for the anonymous viewer. An...
CVE-2026-72723 Discourse: Anonymous sidebar serialization exposes descriptions of category-restricted tags
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, SiteSerializer.anonymousdefaultnavigationmenutags serializes tags from SiteSetting.defaultnavigationmenutags without applying DiscourseTagging.filtervisible for the anonymous viewer. An...
CVE-2026-68319
In the Linux kernel, the following vulnerability has been resolved: pdscore: fix deadlock between reset thread and remove pciresetfunction acquires devicelock before performing the reset. pdscremove is called by the PCI core with devicelock already held. If pdscpciresetthread is running when...
CVE-2026-68143
In the Linux kernel, the following vulnerability has been resolved: net: slip: serialize receive against buffer reallocation slreallocbufs replaces rbuff and updates buffsize while holding sl-lock. slipreceivebuf reads those fields and writes through rbuff without holding the lock. An MTU change...
EUVD-2026-55420
In the Linux kernel, the following vulnerability has been resolved: pdscore: fix deadlock between reset thread and remove pciresetfunction acquires devicelock before performing the reset. pdscremove is called by the PCI core with devicelock already held. If pdscpciresetthread is running when...
CVE-2026-68319
The CVE-2026-68319 entry concerns Linux kernel code where a deadlock could occur between the PCI reset thread and removal path. The root cause was that pci_reset_function() acquires device_lock, and pdsc_remove() is invoked with that lock held; if the reset thread is active, destroy_workqueue() b...
EUVD-2026-55290
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Protect UUID list traversal The hcisync conversion moved class-of-device and EIR generation from an HCI request built under hdev-lock to asynchronous command sync work. The worker holds hdev-reqlock, but that...
CVE-2026-68189
CVE-2026-68189 affects the Linux kernel Bluetooth hci_sync component. A race between asynchronous command sync work and UUID list updates can cause a use-after-free in eir_create due to non-serialized access to hdev->uuids. The fix/mitigation is to hold hdev->lock while generating and commi...
CVE-2026-68143 net: slip: serialize receive against buffer reallocation
In the Linux kernel, the following vulnerability has been resolved: net: slip: serialize receive against buffer reallocation slreallocbufs replaces rbuff and updates buffsize while holding sl-lock. slipreceivebuf reads those fields and writes through rbuff without holding the lock. An MTU change...
PT-2026-81151
Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.59 Description GitPython fails to safely re-serialize multi-line git-config values during write operations. This allows attackers to craft configuration files containing embedded newlines that can be corrupted...
