CVE-2019-20372

Poc for CVE 2019-20372 [email protected] Description NGINX before 1.17.7, with certain errorpage configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer...

nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw

A flaw in the Node.js Permission Model allows attackers to bypass --permission restrictions, enabling unauthorized read or write access to files and directories...

Rocky Linux 9.6 [TuxCare] Security Update: java-21-openjdk / java-21-openjdk-demo / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1794303157)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1794303157 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE...

AlmaLinux 9.6 [TuxCare] Security Update: java-21-openjdk / java-21-openjdk-demo / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1794303157)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1794303157 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component...

Rocky Linux 9.6 [TuxCare] Security Update: java-17-openjdk / java-17-openjdk-demo / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1794301780)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1794301780 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE...

PT-2026-144789

Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited read and write access. Exploitation of this issu...

AlmaLinux 9.6 [TuxCare] Security Update: java-17-openjdk / java-17-openjdk-demo / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1794301780)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1794301780 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component...

CVE-2026-118461: CompuGroup Medical: The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring…

The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring authentication or authorization credentials...

CVE-2026-124451

OpenEMR before 8.4.0 contains an authorization bypass vulnerability in its SMART on FHIR implementation because checkUserHasAccessToPatient in BearerTokenAuthorizationStrategy.php unconditionally returns true. Authenticated users or malicious SMART apps can manipulate token launch context to bind...

EUVD-2026-119509

OpenEMR before 8.4.0 contains an authorization bypass vulnerability in its SMART on FHIR implementation because checkUserHasAccessToPatient in BearerTokenAuthorizationStrategy.php unconditionally returns true. Authenticated users or malicious SMART apps can manipulate token launch context to bind...

PT-2026-139967

OpenEMR before 8.4.0 contains an authorization bypass vulnerability in its SMART on FHIR implementation because checkUserHasAccessToPatient in BearerTokenAuthorizationStrategy.php unconditionally returns true. Authenticated users or malicious SMART apps can manipulate token launch context to bind...

CVE-2026-81744

A flaw was found in Apache OFBiz. This vulnerability allows a remote authenticated attacker to achieve privilege escalation and gain unauthorized read, update, and deletion control over arbitrary content. Due to an improper authorization check in the content permission service, operations that do...

CVE-2026-122006

A flaw was found in Active Storage. When processing file attachments using ImageMagick, the analyzer executes without an adequate security policy to restrict unintended operations. A remote attacker can exploit this vulnerability by uploading a crafted file, allowing unauthorized read and write...

CVE-2026-120463

Warracker before 1.0.4 contains a missing authorization vulnerability in its Paperless-ngx integration that allows an authenticated, non-administrative user to bypass document ownership restrictions by searching for and linking another user's private document ID to a warranty they own using the...

CVE-2026-120463

Warracker versions before 1.0.4 contain a missing authorization vulnerability within its Paperless-ngx integration. The root cause is insufficient authorization checks in the paperless_search_and_link() and serve_paperless_document() route handlers located in file_routes.py. This flaw allows an a...

CVE-2026-120463 Warracker before 1.0.4 Missing Authorization via Paperless-ngx Document Linking

Warracker before 1.0.4 contains a missing authorization vulnerability in its Paperless-ngx integration that allows an authenticated, non-administrative user to bypass document ownership restrictions by searching for and linking another user's private document ID to a warranty they own using the...

PT-2026-135432

Warracker before 1.0.4 contains a missing authorization vulnerability in its Paperless-ngx integration that allows an authenticated, non-administrative user to bypass document ownership restrictions by searching for and linking another user's private document ID to a warranty they own using the...

CVE-2026-120463: sassanix Warracker: Warracker before 1.0.4 contains a missing authorization vulnerability in its Paperless-ngx integration that allows an…

Warracker before 1.0.4 contains a missing authorization vulnerability in its Paperless-ngx integration that allows an authenticated, non-administrative user to bypass document ownership restrictions by searching for and linking another user's private document ID to a warranty they own using the...

CLEANSTART-2026-VV62623 HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory boundaries

Security vulnerability affects the opentofu package. HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory boundaries...

openjdk: Improve C2 loop transformations (Oracle CPU 2026-10)

A flaw was found in OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted input to Compiler component APIs Application Programming Interfaces, such as through a web service. A successful attack can allow unauthorized modification or deletion ...