481 matches found
PT-2026-34553
EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, the admin template management endpoints accept attacker-controlled name and scope values and pass them into template path construction without normalization or traversal filtering. As a result, an...
CVE-2026-40611 Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider
Let's Encrypt client and ACME library written in Go Lego. Prior to 4.34.0, the webroot HTTP-01 challenge provider in lego is vulnerable to arbitrary file write and deletion via path traversal. A malicious ACME server can supply a crafted challenge token containing ../ sequences, causing lego to...
EUVD-2026-24041
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. Versions 3.4.0 through 3.4.9 have a signed integer overflow vulnerability in OpenEXR's HTJ2K High-Throughput JPEG 2000 decompression path. The htundoimp...
BIT-MLFLOW-2025-10279 Privilege Escalation in mlflow/mlflow
In mlflow version 2.20.3, the temporary directory used for creating Python virtual environments is assigned insecure world-writable permissions 0o777. This vulnerability allows an attacker with write access to the /tmp directory to exploit a race condition and overwrite .py files in the virtual...
CVE-2026-33740 EspoCRM: Email importEml can import and delete another user's attachment by raw fileId
EspoCRM is an open source customer relationship management application. In versions 9.3.3 and below, the POST /api/v1/Email/importEml endpoint contains an Insecure Direct Object Reference IDOR vulnerability where the attacker-supplied fileId parameter is used to fetch any attachment directly from...
EUVD-2026-22083
EspoCRM is an open source customer relationship management application. In versions 9.3.3 and below, the POST /api/v1/Attachment/fromImageUrl endpoint is vulnerable to Server-Side Request Forgery SSRF via a DNS rebinding TOCTOU condition. Host validation uses dnsgetrecord but the actual HTTP...
PT-2026-32509
EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below have a stored HTML injection vulnerability that allows any authenticated user with standard non-administrative privileges to inject arbitrary HTML into system-generated email notifications by crafting...
GHSA-8VQR-QJWX-82MW vulnerabilities
Vulnerabilities for packages: ruby3.4-rack, ruby3.2-rack, ruby4.0-rack, ruby3.3-rack, ruby3.4-rails, ruby3.2-rails, logstash, kube-fluentd-operator...
GHSA-Q2WW-5357-X388 vulnerabilities
Vulnerabilities for packages: ruby3.4-rack, ruby3.2-rack, ruby4.0-rack, ruby3.3-rack, ruby3.4-rails, ruby3.2-rails, logstash, kube-fluentd-operator...
CVE-2026-34829 vulnerabilities
Vulnerabilities for packages: ruby3.4-rack, ruby3.2-rack, ruby4.0-rack, ruby3.3-rack, ruby3.4-rails, ruby3.2-rails, logstash, kube-fluentd-operator...
CVE-2026-26962 vulnerabilities
Vulnerabilities for packages: ruby3.4-rails, ruby3.2-rails...
CVE-2026-34230 vulnerabilities
Vulnerabilities for packages: ruby3.4-rack, ruby3.2-rack, ruby4.0-rack, ruby3.3-rack, ruby3.4-rails, ruby3.2-rails, logstash, kube-fluentd-operator...
RCE (Remote Code Execution) org.yaml:snakeyaml Dependency in Jira Service Management Data Center
This is a vulnerability in a non-Atlassian Jira Service Management dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. This Critical severity RCE Remote Code Execution vulnerability was introduced in versions 11.3.3 of Jira Service Management Data...
PT-2026-31073
The LightPress Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the group attribute in the gallery shortcode in all versions up to, and including, 2.3.4. This is due to the plugin modifying gallery shortcode output to include the group attribute value without proper...
SUSE CVE-2026-33026
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui backup restore mechanism allows attackers to tamper with encrypted backup archives and inject malicious configuration during restoration. This issue has been patched in version 2.3.4...
DEBIAN-CVE-2026-34378
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.4.0 to before 3.4.9, a missing bounds check on the dataWindow attribute in EXR file headers allows an attacker to trigger a signed integer overfl...
CVE-2026-34378
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.4.0 to before 3.4.9, a missing bounds check on the dataWindow attribute in EXR file headers allows an attacker to trigger a signed integer overfl...
CVE-2026-5633 assafelovic gpt-researcher ws Endpoint server-side request forgery
A vulnerability was determined in assafelovic gpt-researcher up to 3.4.3. Affected is an unknown function of the component ws Endpoint. Executing a manipulation of the argument sourceurls can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been...
CVE-2026-5630 assafelovic gpt-researcher Report API app.py cross site scripting
A flaw has been found in assafelovic gpt-researcher up to 3.4.3. The impacted element is an unknown function of the file backend/server/app.py of the component Report API. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been...
