6145 matches found
CVE-2026-64501
In the Linux kernel, the following vulnerability has been resolved: iio: adc: adsigmadelta: fix CS held asserted and state leaks In adsigmadeltasingleconversion, setmodeADSDMODEIDLE and disableone were called from the out: block while keepcsasserted was still true. This caused any SPI transfer...
Exploit for Improper Authentication in Sonicwall Directory_Services_Connector
CVE-2020-5148 Forced Authentication in the SonicWall UTM SS...
Linux Distros Unpatched Vulnerability : CVE-2026-64438
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crypto: qat - fix VF2PF work teardown race in adfdisablesriov The VF2PF interrupt handler queues PF- side response work that stores a raw pointer to per-VF stat...
GHSA-HP6V-6JW7-GV2F Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified
Summary Budibase's OIDC SSO login links an incoming SSO identity to an existing Budibase account by email address alone, without ever checking the emailverified claim of the OIDC ID token. Budibase first tries to match the IdP sub; when that misses any fresh attacker IdP account it silently falls...
Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified
Summary Budibase's OIDC SSO login links an incoming SSO identity to an existing Budibase account by email address alone, without ever checking the emailverified claim of the OIDC ID token. Budibase first tries to match the IdP sub; when that misses any fresh attacker IdP account it silently falls...
GHSA-FCRW-F7GG-6G9F Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users
Summary The /api/users/metadata and /api/users/metadata/:id endpoints in @budibase/server return full global user profiles to any user with POWER role or above. For SSO-authenticated users OIDC, Google, the response includes oauth2.accessToken and oauth2.refreshToken fields, leaking identity...
GHSA-W8X7-H2PX-XMQ8 Cloudreve: Broken Access Control in file event stream: a single-file share recipient is subscribed to the owner's parent folder and receives activity events for unshared siblings
Summary When an authenticated recipient of a single-file share opens the file event stream GET /api/v4/file/events?uri=, Cloudreve validates the URI by listing it and then subscribes the caller to parent.ID. For a single-file share, the share navigator resolves the bare share-root URI to the...
Cloudreve: Broken Access Control in file event stream: a single-file share recipient is subscribed to the owner's parent folder and receives activity events for unshared siblings
Summary When an authenticated recipient of a single-file share opens the file event stream GET /api/v4/file/events?uri=, Cloudreve validates the URI by listing it and then subscribes the caller to parent.ID. For a single-file share, the share navigator resolves the bare share-root URI to the...
GHSA-49H3-CWHJ-4737 Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account
Summary Cloudreve's WOPI PUTRELATIVE handler treats X-WOPI-SuggestedTarget as a path, not a filename. It splits the header on / and joins the segments onto the source file's directory with URI.JoinRaw, which feeds Go's url.JoinPath. url.JoinPath resolves ./.. segments, so a slash-bearing target...
Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account
Summary Cloudreve's WOPI PUTRELATIVE handler treats X-WOPI-SuggestedTarget as a path, not a filename. It splits the header on / and joins the segments onto the source file's directory with URI.JoinRaw, which feeds Go's url.JoinPath. url.JoinPath resolves ./.. segments, so a slash-bearing target...
GHSA-R9MR-M37C-5FR3 GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution
Summary GitPython's checkunsafeoptions guard the control introduced by CVE-2026-42215 / GHSA-2f96 and hardened since can be bypassed for every guarded method clone/clonefrom, fetch/pull/push, lsremote, itercommits, blame, archive by smuggling an option token inside the VALUE of a single-character...
GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution
Summary GitPython's checkunsafeoptions guard the control introduced by CVE-2026-42215 / GHSA-2f96 and hardened since can be bypassed for every guarded method clone/clonefrom, fetch/pull/push, lsremote, itercommits, blame, archive by smuggling an option token inside the VALUE of a single-character...
semgrep v1.170.0
Code scanning at ludicrous speed. Semgrep is a fast, open-source, static analysis tool that searches code, finds bugs, and enforces secure guardrails and coding standards. Semgrep supports 30+ languages and can run in an IDE, as a pre-commit check, and as part of CI/CD workflows. Semgrep is...
PT-2026-64434
Name of the Vulnerable Software and Affected Versions Cloudreve versions prior to 4.17.0 Description An authenticated recipient of a single-file share can access file-activity metadata for other files and folders located in the owner's parent folder that were not intended to be shared. This occur...
PT-2026-64431
Name of the Vulnerable Software and Affected Versions Cloudreve versions prior to 4.17.0 Description The WOPI PUT RELATIVE handler incorrectly processes the X-WOPI-SuggestedTarget variable by passing it to URI.JoinRaw as a path instead of a filename. This allows the use of slash and dot-dot...
CVE-2024-58355
Cal.com (calcom/cal.diy) versions up to 4.7.15 are affected by a stored XSS in the booking flow. The vulnerability occurs in the single booking view where booking-question labels are rendered via React’s dangerouslySetInnerHTML without sanitization, allowing an attacker who can create an event ty...
CVE-2026-48012 Shopware SSO referer trust leading to an arbitrary redirect target
Shopware is an open commerce platform. Versions 6.7.3.0 through 6.7.10.0 have an open redirect in Shopware's public SSO entry point at GET /api/oauth/sso/auth. When the endpoint is reached without the expected SSO session state, the application falls back to the request's Referer header and uses...
CVE-2026-48012 Shopware SSO referer trust leading to an arbitrary redirect target
Shopware is an open commerce platform. Versions 6.7.3.0 through 6.7.10.0 have an open redirect in Shopware's public SSO entry point at GET /api/oauth/sso/auth. When the endpoint is reached without the expected SSO session state, the application falls back to the request's Referer header and uses...