5455 matches found
CVE-2026-21723 CVE-2026-21723 Record
The alertmanager templates test endpoint /api/alertmanager/grafana/config/api/v1/templates/test can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with...
CVE-2026-21723
CVE-2026-21723 affects Grafana, specifically the alertmanager templates test endpoint at /api/alertmanager/grafana/config/api/v1/templates/test. The endpoint can execute templates with no memory limits, and mass execution in a short time can cause out-of-memory (OOM) and crash the Grafana service...
PT-2026-63946
Contributor Sensitive Data Exposure in TinyMCE Templates = 4.8.1 versions...
PT-2026-63565
Name of the Vulnerable Software and Affected Versions Grafana affected versions not specified Description The alertmanager templates test endpoint '/api/alertmanager/grafana/config/api/v1/templates/test' allows the execution of templates without memory limits. Sending a large volume of template...
EUVD-2026-46431
Aptabase through commit 5a89368 contains a SQL injection vulnerability in the ClickHouse query backend that allows authenticated attackers to read event data across all tenants by injecting unsanitized filter parameters into Liquid SQL templates. Attackers can supply malicious values through...
CVE-2026-15226 snapd snap-confine Sandbox Confinement Bypass via Omission of setuid Restriction in Seccomp Templates
A sandbox confinement bypass vulnerability exists in Canonical snapd within its internal execution environment compiler snap-confine. The default seccomp security templates generated by the engine to restrict system calls do not filter or reject process operations capable of creating or...
CVE-2026-15226 snapd snap-confine Sandbox Confinement Bypass via Omission of setuid Restriction in Seccomp Templates
A sandbox confinement bypass vulnerability exists in Canonical snapd within its internal execution environment compiler snap-confine. The default seccomp security templates generated by the engine to restrict system calls do not filter or reject process operations capable of creating or...
CVE-2026-15226
Canonically reported vulnerability CVE-2026-15226 affects Canonical snapd’s sandboxed environment (snap-confine). The issue: default seccomp templates did not filter or reject operations to create/manipulate file execution flags with set-user-id attributes, allowing a strictly confined snap to co...
CVE-2026-15226
A sandbox confinement bypass vulnerability exists in Canonical snapd within its internal execution environment compiler snap-confine. The default seccomp security templates generated by the engine to restrict system calls do not filter or reject process operations capable of creating or...
CVE-2026-15226
A sandbox confinement bypass vulnerability exists in Canonical snapd within its internal execution environment compiler snap-confine. The default seccomp security templates generated by the engine to restrict system calls do not filter or reject process operations capable of creating or...
CVE-2026-63728
Gitleaks prior to 8.30.1 contains a template injection vulnerability that allows attackers who can supply or influence report templates to read arbitrary environment variables and exfiltrate sensitive data by leveraging non-hermetic Sprig template functions. Attackers can craft malicious report...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the content parameter of the /templates endpoint. An attacker can execute arbitrary JavaScript code in the browsers of users who view the affected template by injecting malicious scripts. Details Cross-site...
CVE-2026-26483
Mettle SendPortal 3.0.1 and earlier contains a stored cross-site scripting XSS vulnerability in the template management functionality. The application fails to properly sanitize user-supplied input in the content parameter of the /templates endpoint, allowing an attacker to persistently inject...
Exposed Server Reveals AI-Assisted Phishing Toolkit Behind WebDAV Malware Campaign
A malware operator left its delivery server wide open, and Rapid7 pulled down the whole toolkit: 1,048 files spanning lure templates, filename-spoofing tests, execution experiments, droppers, builder notes, and two campaign chains. One was already live against Windows users in Mexico, delivering ...
Important: Red Hat Security Advisory: Red Hat Developer Hub 1.9.7 release.
Red Hat Developer Hub 1.9.7 has been released. Red Hat Developer Hub RHDH is Red Hat's enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters AKS, EKS, GKE. The core features of RHDH include a single...
PT-2026-61736
Name of the Vulnerable Software and Affected Versions NextCRM version 0.12.1 Description The MCP campaign tools expose read and write operations over the network using user-generated Bearer API tokens nxtc .... The application fails to properly validate the authenticated user ID in multiple MCP...
PT-2026-61687
Name of the Vulnerable Software and Affected Versions LimeSurvey versions 6.x through 6.17.10 LimeSurvey versions 7.x through 7.0.4 Description Authenticated users can trigger a server-side request forgery SSRF by providing a manipulated Host header. This occurs due to the unsanitized use of the...
CVE-2026-26483
Mettle SendPortal 3.0.1 and earlier contains a stored cross-site scripting XSS vulnerability in the template management functionality. The application fails to properly sanitize user-supplied input in the content parameter of the /templates endpoint, allowing an attacker to persistently inject...
CVE-2026-26483
Summary: CVE-2026-26483 affects Mettle SendPortal 3.0.1 and earlier. A stored cross-site scripting (XSS) vulnerability exists in the template management functionality where input in the content parameter of the /templates endpoint is not properly sanitized, enabling an attacker to persistently in...