122499 matches found
CVE-2026-82331
A flaw was found in the tar source plugin of Apache BuildStream. This improper link resolution vulnerability, also known as 'link following', allows a remote attacker to write arbitrary files on the host system. By crafting malicious source tarballs containing symlinks, an attacker can exploit th...
Important: rclone
Issue Overview: The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback,...
PT-2026-102403
Name of the Vulnerable Software and Affected Versions OpenDKIM versions prior to 2.11.1 Description A security flaw exists in the Tag Tokenizer component within the dkim process set function of the dkim.c file. A remote attacker can perform a manipulation that results in the use of a less trusted...
Information Exposure
Overview Affected versions of this package are vulnerable to Information Exposure via the GET /api/station/id/vue/profile endpoint. An attacker can obtain sensitive credentials, including admin, source, and relay passwords, by making authenticated requests with only View Station Page permission...
PT-2026-99489
Name of the Vulnerable Software and Affected Versions coollabsio Coolify versions prior to 4.1.1 Description A remote issue exists in the GitHub App Setup Handler component within the Github::redirect function of the /webhooks/source/github/redirect file. Manipulation of the state argument allows...
magento-instant-purchase-custom-price
abraxaslabs.tech · github.com/abraxas ·&...
Use of Less Trusted Source
Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Use of Less Trusted Source via incomplete propagation of revision and coderevision pins across artifact boundaries in the model loader subsystem. Wh...
CVE-2026-100688
Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint that allows authenticated users to read another tenant's application metadata and source code. Attackers can supply a victim tenant's app id to retrie...
CVE-2026-100688 Budibase server before 3.45.0 Cross-Tenant Information Disclosure
Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint that allows authenticated users to read another tenant's application metadata and source code. Attackers can supply a victim tenant's app id to retrie...
CVE-2026-100688
Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint that allows authenticated users to read another tenant's application metadata and source code. Attackers can supply a victim tenant's app id to retrie...
CVE-2026-100688 Budibase server before 3.45.0 Cross-Tenant Information Disclosure
Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint that allows authenticated users to read another tenant's application metadata and source code. Attackers can supply a victim tenant's app id to retrie...
CVE-2026-100688
Budibase server versions prior to 3.45.0 are vulnerable to a cross-tenant information disclosure vulnerability within the GET /api/applications/:appId/appPackage endpoint. The root cause is a lack of authorization checks , allowing authenticated users to access metadata and source code belonging ...
EUVD-2026-87661
Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint that allows authenticated users to read another tenant's application metadata and source code. Attackers can supply a victim tenant's app id to retrie...
CVE-2026-100688 Budibase server before 3.45.0 Cross-Tenant Information Disclosure
Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint that allows authenticated users to read another tenant's application metadata and source code. Attackers can supply a victim tenant's app id to retrie...
Exploit for Unrestricted Upload of File with Dangerous Type in Adobe Commerce
abraxaslabs.tech · github.com/abraxas ·&...
Exploit for Improper Neutralization of Special Elements Used in a Template Engine in Adobe Commerce
abraxaslabs.tech · github.com/abraxas ·&...
CVE-2026-100536
Versions of OpenClaw prior to 2026.8.1 are vulnerable to a path traversal flaw within structured message attachments . The root cause is a failure to validate all source fields, which allows attackers to provide multiple source fields to bypass sandbox path validation . This enables the delivery ...
CVE-2026-100527
Versions of OpenClaw prior to 2026.8.2 are vulnerable to a denial of service (DoS) flaw within the Browser extension relay . This issue allows unauthenticated network sources to exhaust pending-authentication capacity by maintaining silent WebSocket upgrades . By occupying every available pending...
CLEANSTART-2026-OJ26404 Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...
Security vulnerability affects the loki package. Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped...
Karma Pro 0.11
Karma Pro is an open source code review tool written in Swift that can assist code reviewers with a multitude of useful tools. Karma Pro is a macOS source-code security scanner AST base and Heuristics that statically analyses projects in multiple languages. It's backed by an ML classifier trained...