30181 matches found
PT-2026-55222
Name of the Vulnerable Software and Affected Versions Drupal Canvas versions 0.0.0 through 1.4.2 Drupal Canvas versions 1.5.0 through 1.5.2 Drupal Canvas versions 1.6.0 through 1.6.1 Drupal Canvas versions 1.7.0 through 1.7.1 Description An issue exists in the Canvas AI submodule where image file...
PT-2026-54931
Name of the Vulnerable Software and Affected Versions allegroai/clearml versions prior to 2.1.6 Description Relative path traversal occurs during the extraction of .zip archives via the ZipFile.extractall method within the StorageManager. extract to cache function. This is caused by a lack of pat...
Oracle Linux 9 : kernel (ELSA-2026-19568)
The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-19568 advisory. - net/sched: fix pedit partial COW leading to page cache corruption Ivan Vecera RHEL-177392 CVE-2026-46331 - scsi: qla2xxx: Completely fix fcport doub...
CVE-2026-58454: Improper Control of Generation of Code
JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a remote code execution vulnerability that allows authenticated attackers to execute arbitrary shell scripts by writing to the writable persistent JFFS2 storage path and triggering execution through the authenticated HTT...
The hardware and software solutions for data storage and information processing of Dell PowerFlex Manager, PowerFlex Appliance, and PowerFlex Rack are vulnerable due to the insecure storage of confidential information. This vulnerability allows attackers to gain unauthorized access to protected information.
The vulnerabilities of hardware and software solutions for data storage and information processing in Dell PowerFlex Manager, PowerFlex Appliance, and PowerFlex Rack involve insecure storage of confidential information. Exploiting these vulnerabilities can allow attackers to gain unauthorized...
The vulnerability of the Active Storage component of the Ruby on Rails software framework allows attackers to execute arbitrary code.
The vulnerability of the Active Storage component in the Ruby on Rails programming framework is related to insufficient checking of the intentions by the recipient of the broadcast message. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
The hardware and software solutions for data storage and information processing of Dell PowerFlex Manager, PowerFlex Appliance, and PowerFlex Rack are vulnerable due to the insecure storage of confidential information. This vulnerability allows attackers to gain unauthorized access to confidential information.
The vulnerabilities of hardware and software solutions for data storage and information processing in Dell PowerFlex Manager, PowerFlex Appliance, and PowerFlex Rack involve insecure storage of confidential information. Exploiting these vulnerabilities can allow attackers to gain unauthorized...
PT-2026-54916
Name of the Vulnerable Software and Affected Versions JAIOTlink C492A-W6 version 4.8.30.57701411 Description Authenticated attackers can achieve persistent remote code execution by writing arbitrary shell scripts to the writable persistent JFFS2 storage path. The execution is triggered through an...
Linux Distros Unpatched Vulnerability : CVE-2026-14155
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HT...
BIT-SEAWEEDFS-2026-54917 SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access
SeaweedFS is a distributed storage system for object storage S3, file systems, and Iceberg tables. Prior to 4.30, the S3 API gateway and the Iceberg REST catalog gateway construct their routers with mux.NewRouter.SkipCleantrue. With path cleaning disabled, a .. segment inside the URL survives...
BIT-GHOST-2026-53948 Ghost: File Upload Content-Type Spoofing
Ghost is a Node.js content management system. From 6.19.4 until 6.21.1, insufficient validation of the client-supplied Content-Type on Ghost's Admin API file upload endpoint allowed uploaded files to be served from the site with an attacker-chosen content type on S3/GCS storage backends. On...
CVE-2026-56413
Storage Concentrator SC & SCVM contains a command injection vulnerability in the msservice.pl service, which listens on TCP port 9000 by default and accepts custom network packets to perform device actions. An unauthenticated remote attacker can send a specially crafted packet containing a...
CVE-2026-56415
Storage Concentrator SC & SCVM contains a command injection vulnerability within the debug.pl script that is reachable without authentication. A remote attacker can submit a specially crafted HTTP request containing a malicious payload that is processed without adequate input sanitization,...
CVE-2026-50040
Storage Concentrator SC & SCVM is vulnerable to reflected cross-site scripting due to unsanitized content being echoed back in 404 error pages. An attacker can craft a malicious URL that, when visited by an authenticated user, causes arbitrary script content to execute within the victim's browser...
CVE-2026-50110
Storage Concentrator SC & SCVM contains hardcoded credentials for numerous internal services embedded within a configuration file. While the credentials are stored in an encoded format, the encoding can be reversed to plaintext. The exposed credentials span a broad range of internal services,...
DEBIAN-CVE-2026-14155
Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...
CVE-2026-14156
Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. Chromium security severity: Low...
CVE-2026-14155
Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...
DEBIAN-CVE-2026-14156
Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. Chromium security severity: Low...