EUVD-2026-107047

In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scoped 'member' or 'reader' role making the Block Storage API v3.3 "List messages" call finds the non-expired user messages for other projects included in the...

CVE-2026-93856

In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scoped 'member' or 'reader' role making the Block Storage API v3.3 "List messages" call finds the non-expired user messages for other projects included in the...

CVE-2026-93856

In OpenStack Cinder (through version 29.0.0 ), a flaw in the Messages API allows for cross-project information disclosure . An authenticated non-admin user with project-scoped 'member' or 'reader' roles can use the Block Storage API v3.3 "List messages" call to retrieve non-expired messages belon...

CVE-2026-93856

In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scoped 'member' or 'reader' role making the Block Storage API v3.3 "List messages" call finds the non-expired user messages for other projects included in the...

CVE-2026-93856

In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scoped 'member' or 'reader' role making the Block Storage API v3.3 "List messages" call finds the non-expired user messages for other projects included in the...

CVE-2026-114117

Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which msg.value | K or lenmsg.data | K, where K is any nonzero integer literal, is compiled to the constant 1 when used as a ternary expression branch under -O gas the default or -O codesize. Affected contracts use the wrong valu...

CVE-2026-114082

Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or tr...

CVE-2021-48018

Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locations as contract storage variables. When a function using @nonreentrant is called, setting the lock overwrites the overlapping storage variable, corrupting contract state and breaking the...

EUVD-2026-106920

Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which msg.value | K or lenmsg.data | K, where K is any nonzero integer literal, is compiled to the constant 1 when used as a ternary expression branch under -O gas the default or -O codesize. Affected contracts use the wrong valu...

CVE-2026-114117

Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which msg.value | K or lenmsg.data | K, where K is any nonzero integer literal, is compiled to the constant 1 when used as a ternary expression branch under -O gas the default or -O codesize. Affected contracts use the wrong valu...

CVE-2026-114082

Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or tr...

CVE-2026-114082 Trigger.dev before 4.6.2 Overly Broad Realtime Session Stream Credentials

Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or tr...

CVE-2026-114082 Trigger.dev before 4.6.2 Overly Broad Realtime Session Stream Credentials

Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or tr...

CVE-2026-114082

Versions of Trigger.dev before 4.6.2 are susceptible to an authorization vulnerability involving overly broad realtime session stream credentials . Public-token holders with session write access can obtain environment-wide S2 stream credentials through session input initialization. This allows an...

EUVD-2026-106885

Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or tr...

CVE-2021-48018 Vyper 0.2.13 before 0.2.15 Storage Corruption via @nonreentrant Decorator

Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locations as contract storage variables. When a function using @nonreentrant is called, setting the lock overwrites the overlapping storage variable, corrupting contract state and breaking the...

CVE-2021-48018

Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locations as contract storage variables. When a function using @nonreentrant is called, setting the lock overwrites the overlapping storage variable, corrupting contract state and breaking the...

CVE-2021-48018

The Vyper compilation tool, versions 0.2.13 through 0.2.14 , is vulnerable to storage corruption due to a flaw in the @nonreentrant decorator. The compiler incorrectly allocates storage slots for reentrancy locks at the same locations as contract storage variables. Consequently, executing a funct...

EUVD-2021-34888

Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locations as contract storage variables. When a function using @nonreentrant is called, setting the lock overwrites the overlapping storage variable, corrupting contract state and breaking the...

EUVD-2026-106762

Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems component: Core. The supported version that is affected is 8.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit. Successful...