252783 matches found
CVE-2026-47626
NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause an out-of-bounds write. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, denial of service, information disclosure, and data tamperi...
EUVD-2026-65603
NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause an out-of-bounds write. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, denial of service, information disclosure, and data tamperi...
CVE-2026-24262
NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause an out-of-bounds write. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, denial of service, information disclosure, and data tamperi...
EUVD-2026-65602
NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause an out-of-bounds write. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, denial of service, information disclosure, and data tamperi...
CVE-2026-55541
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, praisonai serve agents and praisonai serve unified parse --api-key but createagentsapp and createunifiedapp do not install a credential check. Unauthenticated callers can reach POST /agents and POST /api/v1/agents/id/invoke. This...
CVE-2026-55539
PraisonAI, a multi-agent teams system, exposed its async Jobs API (/api/v1/runs) without authentication prior to version 4.6.51. The create_app function mounted the endpoint with no access control, allowing any reachable caller to submit jobs, read results, cancel runs, or delete jobs using opera...
CVE-2026-55539 PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, the Jobs API createapp function mounts /api/v1/runs without authentication. Any reachable caller can submit jobs, read results, cancel runs, or delete jobs using operator credentials. The fix adds PRAISONAIJOBSAPIKEY middleware f...
Malicious code in svelte-streak-map (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b054f1d8e8f496e3bdabacf1bf5042b2aba5f9587646cbb874ae9e3ec9c7c7f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
CVE-2026-52490
A flaw was found in libtiff. An attacker can exploit a vulnerability in the processcommandopts function within tools/tiffcrop.c to execute arbitrary code. This could lead to a complete compromise of the affected system. Mitigation Avoid using the tiffcrop utility to process TIFF image files from...
CVE-2026-79666
Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated user to access system logs. Attackers with valid user sessions can query GET /api/system/logs and subscribe to SSE and WebSocket log streams to retrieve sensitive operational data...
ROOT-OS-DEBIAN-12-CVE-2021-46242 CVE-2021-46242 in hdf5 - Patched by Root
Root has patched CVE-2021-46242 in the hdf5 package for Root:Debian:12. Multiple fixed versions available...
ROOT-OS-DEBIAN-12-CVE-2025-2153 CVE-2025-2153 in hdf5 - Patched by Root
Root has patched CVE-2025-2153 in the hdf5 package for Root:Debian:12. Multiple fixed versions available...
CVE-2026-79669
Ech0 versions before 4.4.3 lack authorization checks on system log endpoints, allowing any authenticated non-admin user to read and stream all server logs. The vulnerable endpoints are GET /api/system/logs , GET /api/system/logs/stream , and WS /ws/system/logs . An attacker can gather reconnaissa...
EUVD-2026-65445
Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access historical logs and real-time log streams via GET /api/system/logs, GET /api/system/logs/stream, and WS /ws/system/logs to gather...
CVE-2026-79669 Ech0 before 4.4.3 Missing Authorization on System Logs
Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access historical logs and real-time log streams via GET /api/system/logs, GET /api/system/logs/stream, and WS /ws/system/logs to gather...
CVE-2026-79669 Ech0 before 4.4.3 Missing Authorization on System Logs
Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access historical logs and real-time log streams via GET /api/system/logs, GET /api/system/logs/stream, and WS /ws/system/logs to gather...
EUVD-2026-65448
Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated user to access system logs. Attackers with valid user sessions can query GET /api/system/logs and subscribe to SSE and WebSocket log streams to retrieve sensitive operational data...
ROOT-OS-DEBIAN-12-CVE-2025-10911 CVE-2025-10911 in libxslt - Patched by Root
Root has patched CVE-2025-10911 in the libxslt package for Root:Debian:12. Multiple fixed versions available...