42326 matches found
GHSA-CWPP-325Q-2CVP Statamic Vulnerable to Server-Side Request Forgery via Glide
Impact When Glide image manipulation is used in insecure mode which is not the default, the image proxy can be abused by an unauthenticated user to make the server send HTTP requests to arbitrary URLs—either via the URL directly or via the watermark feature. That can allow access to internal...
Linux Distros Unpatched Vulnerability : CVE-2026-3172
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Buffer overflow in parallel HNSW index build in pgvector 0.6.0 through 0.8.1 allows a database user to leak sensitive data from other relations or crash the...
PT-2026-22521
Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.0 Description Missing authentication for the registration endpoint allows a remote attacker to overwrite administrator email information and abuse the server as an outbound relay. Recommendations...
CVE-2026-27653
The installers for multiple products provided by Soliton Systems K.K. contain an issue with incorrect default permissions, which may allow arbitrary code to be executed with SYSTEM privileges...
GHSA-2X45-7FC3-MXWQ vulnerabilities
Vulnerabilities for packages: zabbix-fips, zabbix...
Linux Distros Unpatched Vulnerability : CVE-2026-2807
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory safety bugs present in Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort so...
GHSA-465P-V42X-3FMJ vulnerabilities
Vulnerabilities for packages: kots...
CVE-2026-21619
Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hexcore hexapi modules, hexpm hex mixhexapi modules, erlang rebar3 r3hexapi modules allows Object Injection, Excessive Allocation. This vulnerability is associated with program files src/hexapi.erl,...
Malicious code in dgxeon-soket (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bc1fe5368b07366735c8e9f8163262c8e77e1be50c66c9158459b89cf348cac The package dgxeon-soket was found to contain malicious code. Source: ghsa-malware 7814fe539784c04cc6450ee43c3902eab63d439030fa47b7678ccb32e8655119 A...
MAL-2026-1069 Malicious code in @skyzopedia/libsignal-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d2851df7c45fca156556e4b7c5fef4c60ed254a43c4e6e51c6e02d8b5ca5a20 The package @skyzopedia/libsignal-node was found to contain malicious code. Source: ghsa-malware...
Incorrect Default Permissions
Overview Affected versions of this package are vulnerable to Incorrect Default Permissions in the clihistory feature. An attacker can access sensitive command history and API request/response data by reading the history database file if it is created with default permissions on a multi-user Unix...
CVE-2026-3062 vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2026-3063 vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-5476-XC4J-RQCV vulnerabilities
Vulnerabilities for packages: debezium...
CVE-2026-27727 vulnerabilities
Vulnerabilities for packages: hono, debezium...
CVE-2026-27099 vulnerabilities
Vulnerabilities for packages: jenkins...
Improper file access permission settings in the installers for multiple Soliton Systems products
Overview The installers for multiple products provided by Soliton Systems K.K. contain the following vulnerability. Incorrect default permissions CWE-276 - CVE-2026-27653 Kazuma Matsumoto of GMO Cybersecurity by IERAE, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the...
EUVD-2026-8998
The installers for multiple products provided by Soliton Systems K.K. contain an issue with incorrect default permissions, which may allow arbitrary code to be executed with SYSTEM privileges...
