24712 matches found
EUVD-2026-40442
Capgo before 12.128.2 lacks an UPDATE row-level security policy for the buildrequests table, preventing API-key and anonymous access from persisting builder status updates. Attackers can exploit this missing policy to cause build status and error details to remain unpersisted, leaving buildreques...
Linux Distros Unpatched Vulnerability : CVE-2026-13976
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient data validation in Storage in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentiall...
CVE-2026-56334
Capgo before 12.128.2 lacks an UPDATE row-level security policy for the buildrequests table, preventing API-key and anonymous access from persisting builder status updates. Attackers can exploit this missing policy to cause build status and error details to remain unpersisted, leaving buildreques...
CVE-2026-50003
creationtimestamp| type| source ---|---|--- 2026-06-30 22:51:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpk3ooy4n423 2026-07-01 02:36:40+00:00| seen| https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-181-01 2026-07-02 20:45:13+00:00| seen|...
CVE-2026-56334 Capgo - Missing UPDATE RLS Policy for Build Status Persistence
Capgo before 12.128.2 lacks an UPDATE row-level security policy for the buildrequests table, preventing API-key and anonymous access from persisting builder status updates. Attackers can exploit this missing policy to cause build status and error details to remain unpersisted, leaving buildreques...
CVE-2026-56334
Capgo before 12.128.2 is affected by an insufficient UPDATE row-level security (RLS) policy on the build_requests table. The missing policy allows API-key and anonymous access to persist builder status updates to be blocked or unpersisted, resulting in build status and error details remaining in ...
CVE-2026-56318
Capgo before 12.128.2 contains an information disclosure vulnerability in the /private/validatepasswordcompliance endpoint that returns different error responses for malformed, non-existent, and existing organization IDs. Unauthenticated attackers can enumerate valid organization UUIDs by observi...
CVE-2026-8864
creationtimestamp| type| source ---|---|--- 2026-06-30 18:11:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpjm2lvbnn2u...
CVE-2026-58377
creationtimestamp| type| source ---|---|--- 2026-06-30 17:59:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpjlfnxyxp2d 2026-07-02 05:59:13+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpne2y63yj22...
CVE-2025-23351
creationtimestamp| type| source ---|---|--- 2026-06-30 16:30:28+00:00| seen| https://infosec.exchange/users/AAKL/statuses/116840007230776932 2026-07-01 17:03:35+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mplypz6an627 2026-07-02 01:57:01+00:00| seen|...
CVE-2026-58371
SeaweedFS before 4.30 is vulnerable to cross-origin information disclosure via an unvalidated JSONP callback parameter. The shared writeJson helper can reflect the callback verbatim into responses served as application/javascript without callback-name validation, missing X-Content-Type-Options: n...
CVE-2026-58371 SeaweedFS < 4.30 - Cross-Origin Information Disclosure via Unvalidated JSONP callback Parameter
SeaweedFS before 4.30 reflects the callback query parameter verbatim into responses served with Content-Type application/javascript in the shared writeJson helper weed/server/common.go, with no callback-name validation, no X-Content-Type-Options: nosniff header, and no CORS allow-list. Every JSON...
CVE-2026-58371 SeaweedFS < 4.30 - Cross-Origin Information Disclosure via Unvalidated JSONP callback Parameter
SeaweedFS before 4.30 reflects the callback query parameter verbatim into responses served with Content-Type application/javascript in the shared writeJson helper weed/server/common.go, with no callback-name validation, no X-Content-Type-Options: nosniff header, and no CORS allow-list. Every JSON...
MINI-6939-C56M-MHC9
Bulletin has no description...
MINI-5MVV-94R6-WX2X
Bulletin has no description...
PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation
A flaw was found in PHP, specifically within the PHP-FPM status page. Due to improper sanitation of user data, a remote attacker can craft a malicious URL. When a user views the PHP-FPM status page with this crafted URL, it can lead to the execution of arbitrary JavaScript code Cross-Site Scripti...
CVE-2022-24812
creationtimestamp| type| source ---|---|--- 2026-06-30 10:51:46+00:00| seen| https://infosec.exchange/users/certvde/statuses/116838675578498232...
EDB-50321
creationtimestamp| type| source ---|---|--- 2026-06-30 09:23:07+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/f5772856-05e8-4057-9431-7fa5d570eab3...
