122492 matches found
CVE-2026-76276
In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could retrieve original source code for the Discover Splunk Observability Cloud app through Splunk Web. The vulnerability is possible because production...
CVE-2026-76276
Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10 are vulnerable to an information disclosure flaw in the Discover Splunk Observability Cloud app via Splunk Web. A low-privileged user lacking "admin" or "power" roles can retrieve the app's original source code because production JavaSc...
EUVD-2026-94628
In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could retrieve original source code for the Discover Splunk Observability Cloud app through Splunk Web. The vulnerability is possible because production...
CVE-2026-76276 Information Disclosure in the Discover Splunk Observability Cloud app through Splunk Web for Splunk Enterprise
In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could retrieve original source code for the Discover Splunk Observability Cloud app through Splunk Web. The vulnerability is possible because production...
EUVD-2026-93999
Backstage's scaffolder credential handling may allow unintended GitHub authentication fallback...
Backstage: Scaffolder action input authorization bypass
Impact An authenticated user with access to affected Scaffolder templates could bypass configured action restrictions. Depending on integration credentials, this could grant unauthorized access to repositories and related source-control resources. Patches Patched in...
EUVD-2026-94068
Backstage: Scaffolder action input authorization bypass...
GHSA-HMP2-4M7G-22CV Backstage: Scaffolder action input authorization bypass
Impact An authenticated user with access to affected Scaffolder templates could bypass configured action restrictions. Depending on integration credentials, this could grant unauthorized access to repositories and related source-control resources. Patches Patched in...
CVE-2026-106503
A flaw was found in the Backstage plugin-scaffolder-backend component. An authorization bypass allows an authenticated user with access to Scaffolder templates to circumvent configured action restrictions. By manipulating action inputs, an attacker can leverage integration credentials to gain...
SUSE CVE-2026-93317
An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The resulting snapshot could be cached under that digest and reused by a later victim build, compromising build-input integrity...
qemu
QEMU LÉEME QEMU es un emulador y virtualizador de máquinas y espacio de usuario genérico y de código abierto. QEMU es capaz de emular una máquina completa mediante software sin necesidad de soporte de virtualización por hardware. Mediante el uso de traducción dinámica, alcanza un rendimiento muy...
CVE-2026-107174
A flaw was found in source-to-image. When unpacking archive files, the application fails to properly sanitize symbolic links pointing to absolute file paths. An attacker who supplies a malicious builder image can exploit this vulnerability by embedding links pointing outside the extraction...
CVE-2026-107174
A security boundary bypass vulnerability exists in source-to-image due to improper sanitization of symbolic links during archive unpacking. An attacker providing a malicious builder image can embed absolute symbolic links pointing outside the extraction directory. This flaw allows the attacker to...
EUVD-2026-94367
A flaw was found in source-to-image. When unpacking archive files, the application fails to properly sanitize symbolic links pointing to absolute file paths. An attacker who supplies a malicious builder image can exploit this vulnerability by embedding links pointing outside the extraction...
CVE-2026-107174 Source-to-image: source-to-image: security boundary bypass via absolute symbolic link extraction
A flaw was found in source-to-image. When unpacking archive files, the application fails to properly sanitize symbolic links pointing to absolute file paths. An attacker who supplies a malicious builder image can exploit this vulnerability by embedding links pointing outside the extraction...
CVE-2026-107174
A flaw was found in source-to-image. When unpacking archive files, the application fails to properly sanitize symbolic links pointing to absolute file paths. An attacker who supplies a malicious builder image can exploit this vulnerability by embedding links pointing outside the extraction...
SUSE CVE-2026-63277
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such a link to be loaded from a remote location, so opening the document could run Java code from that location. In fixed versions an entry in...
PT-2026-107537
A flaw was found in source-to-image. When unpacking archive files, the application fails to properly sanitize symbolic links pointing to absolute file paths. An attacker who supplies a malicious builder image can exploit this vulnerability by embedding links pointing outside the extraction...
Debian dla-4826 : puma - security update
The remote Debian 12 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4826 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4826-1 [email protected]...
CVE-2026-76276: Initialization of a Resource with an Insecure Default
In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could retrieve original source code for the Discover Splunk Observability Cloud app through Splunk Web. The vulnerability is possible because production...