14967 matches found
EUVD-2026-58728
CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning...
zotlit-PoC
ZotLit: security advisory CVE status: requested, pendin...
WordPress Shared Files Pro plugin < 1.7.70 - Unauthenticated Arbitrary File Read vulnerability
Unauthenticated Arbitrary File Read vulnerability discovered by Erwan LR WPScan in WordPress Plugin Shared Files Pro versions 1.7.70...
CVE-2026-74994
A flaw was found in the modauth module of OTP's inets httpd server. When configured with multiple directory configuration blocks and using dets or mnesia authentication backends, the module incorrectly collapses all directory blocks into a single shared user/group namespace. This allows a user...
UBUNTU-CVE-2026-65107
Fix sbcast shared objects skipping credential verification, Fix possible slurmd crash on invalid sbcast filenames...
CVE-2026-65107
Fix sbcast shared objects skipping credential verification, Fix possible slurmd crash on invalid sbcast filenames...
Linux Distros Unpatched Vulnerability : CVE-2026-74994
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The modauth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collaps...
libcurl 7.44.0 < 8.22.0 HTTP/2 Server Push Use-After-Free
The version of libcurl installed on the remote host is 7.44.0 prior to 8.22.0. It is, therefore, affected by a use-after-free vulnerability: - A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to...
CVE-2026-18718 — Updated!
Advisory: GHSA-pcfh-853f-q3gh · Severity: High CVSS 7.5 · Affected: Ghidra ≤ 12.1.2 · Fixed: c03a70d Ghidra 12.1.3 Opening someone else's Ghidra project was enough to execute their code. Ghidra 12.1.2 stores analyzer options inside the program database , and one of those options is a filesystem...
Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE
Summary An authenticated user with edit access to their own session can overwrite a shared/template agent by uploading a full agent bundle through PUT /sessions/sessionid/agent. Shared/template agents are shown as not MCP-editable, but this upload path still accepts a replacement bundle. By addin...
EUVD-2026-64016
Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE...
GHSA-JRRM-9HC7-2V3H Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE
Summary An authenticated user with edit access to their own session can overwrite a shared/template agent by uploading a full agent bundle through PUT /sessions/sessionid/agent. Shared/template agents are shown as not MCP-editable, but this upload path still accepts a replacement bundle. By addin...
GHSA-68JP-44VC-2X5H vulnerabilities
Vulnerabilities for packages: wazuh-dashboard-fips, kibana, redisinsight, kubeflow-centraldashboard, prism, awx, wazuh-dashboard, azurite, gitlab-rails-ce, langfuse, gitlab-rails-ce-fips, opensearch-dashboards-fips, langfuse-fips, librechat, jitsucom-jitsu, lerna, opensearch-dashboards, semaphore...
GO-2026-6306 Vikunja has an incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0 in code.vikunja.io/api
Vikunja has an incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parentprojectid=0 in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module...
CVE-2026-77123
Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability read API. An account holding the nexus:capabilities:read privilege can retrieve the plaintext shared secret configured on a webhook capability, which is intended to be masked from all API responses. Thi...
CVE-2026-77123
Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability read API. An account holding the nexus:capabilities:read privilege can retrieve the plaintext shared secret configured on a webhook capability, which is intended to be masked from all API responses. Thi...
CVE-2026-84663
A cross-site request forgery CSRF vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows attackers to delete shared library caches...
CVE-2026-84663
A cross-site request forgery CSRF vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows attackers to delete shared library caches...
CVE-2026-84663
The Jenkins Pipeline: Groovy Libraries Plugin (also identified as pipeline-groovy-lib) version 798.v5cc688825312 and earlier is vulnerable to a cross-site request forgery (CSRF) . The root cause is that the plugin does not require POST requests for a specific HTTP endpoint, which allows an attack...