301105 matches found
CLEANSTART-2026-QG86215 Security fixes in wso2is 7.1.0-r0
Package wso2is version 7.1.0-r0 fixes 17 vulnerabilities: CVE-2025-8671, CVE-2025-23184, CVE-2025-48734, CVE-2025-48795, CVE-2025-48924...
CLEANSTART-2026-FH61032 Security fixes in metrics-server 0.8.1-r2
Package metrics-server version 0.8.1-r2 fixes 13 vulnerabilities: CVE-2026-33186, ghsa-p77j-4mvh-x3m3, ghsa-hrxh-6v49-42gf, CVE-2026-42154, ghsa-8rm2-7qqf-34qm...
CLEANSTART-2026-NI09803 Security fixes in metrics-server 0.8.1-r5
Package metrics-server version 0.8.1-r5 fixes 6 vulnerabilities: CVE-2026-42154, CVE-2026-42151, CVE-2026-44903, ghsa-wg65-39gg-5wfj, ghsa-fw8g-cg8f-9j28...
CLEANSTART-2026-IJ26025 Security fixes in metrics-server 0.8.1-r3
Package metrics-server version 0.8.1-r3 fixes 13 vulnerabilities: CVE-2026-33186, ghsa-p77j-4mvh-x3m3, ghsa-hrxh-6v49-42gf, CVE-2026-42151, CVE-2026-42154...
CLEANSTART-2026-SP46945 Security fixes in percona-server-mongodb-operator 1.23.0-r0
Package percona-server-mongodb-operator version 1.23.0-r0 fixes 22 vulnerabilities: CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832...
CVE-2026-73627
JupyterLab pip package 'jupyterlab' versions =4.1.0,=4.6.0,=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow an authenticated user to circumvent administrator lock rules by making direct requests to the /lab/api/plugins endpoint, enabling or...
EUVD-2026-57822
Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON metacharacters. Attackers with query write permission can inject JSON...
CVE-2026-73618
Budibase Server prior to 3.40.0 is affected by a NoSQL injection in the MongoDB query execution endpoint. User-supplied parameters are interpolated into JSON query templates without sanitizing JSON metacharacters, allowing attackers with query write permission to inject JSON structural characters...
CVE-2026-73618 Budibase Server before 3.40.0 NoSQL Injection via JSON Parameter
Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON metacharacters. Attackers with query write permission can inject JSON...
Moderate: Red Hat Security Advisory: gnome-remote-desktop security update
An update for gnome-remote-desktop is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
Fleet Server 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-93)
Improper Control of Generation of Code in Fleet Server Leading to Code Injection Description: Improper Control of Generation of Code 'Code Injection' CWE-94 in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection CAPEC-242. Kibana accepted an identifier fo...
Fleet Server 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-112)
Authorization Bypass Through User-Controlled Key in Fleet Server Leading to Information Disclosure Authorization Bypass Through User-Controlled Key CWE-639 in Fleet Server can lead to information disclosure via Manipulating User-Controlled Variables CAPEC-77. The authorization decision for artifa...
Elastic Cloud on Kubernetes 3.5.0 Security Update (ESA-2026-113)
Cleartext Storage of Sensitive Information in an Environment Variable in Elastic Cloud on Kubernetes Leading to Information Disclosure Cleartext Storage of Sensitive Information in an Environment Variable CWE-526 in Elastic Cloud on Kubernetes ECK can lead to information disclosure via Retrieve...
CVE-2026-59504
CWE-602: Client-Side Enforcement of Server-Side Security...
CVE-2026-59504 Priority – CWE-602: Client-Side Enforcement of Server-Side Security
CWE-602: Client-Side Enforcement of Server-Side Security...
CVE-2026-59504
CWE-602: Client-Side Enforcement of Server-Side Security...
EUVD-2026-57771
CWE-602: Client-Side Enforcement of Server-Side Security...
JLSEC-2026-1274 code-server's session cookie can be extracted by having user visit specially crafted proxy URL
Summary A maliciously crafted URL using the proxy subpath can result in the attacker gaining access to the session token. Details Failure to properly validate the port for a proxy request can result in proxying to an arbitrary domain. The malicious URL https:///proxy/[email protected]/path would be...
CVE-2026-72506
VoiceTra provided by National Institute of Information and Communications Technology NICT contains an incorrectly specified destination in a communication channel vulnerability. Users may be directed to a server or service controlled by an attacker, potentially resulting in the theft of input dat...
