CVE-2026-24140

CVE-2026-24140 involves a mass assignment vulnerability in MyTube (versions 1.7.78 and earlier) where the saveSettings() function accepts arbitrary key-value pairs and persists them to the database without validating property names. The underlying cause is input handling with Record and unfiltere...

Incorrect Authorization

Overview actingweb is a The official ActingWeb library Affected versions of this package are vulnerable to Incorrect Authorization due to missing permission filtering in the listall method in the actingweb/handlers/properties.py. An attacker can access and list properties they are not authorized ...

GHSA-JH66-3545-VPM7 Apache Druid: Users can provide MySQL JDBC properties not on allow list

Apache Druid allows users with certain permissions to read data from other database systems using JDBC. This functionality allows trusted users to set up Druid lookups or run ingestion tasks. Druid also allows administrators to configure a list of allowed properties that users are able to provide...