121526 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-60160
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.12. Easily exploitable...
openSUSE 16 Security Update : perl-DBI (openSUSE-SU-2026:21412-1)
The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21412-1 advisory. - CVE-2026-15392: failure to validate symbolic links during table path resolution could allow unauthorized file reads and writes outside the...
Improper Authentication
Overview Affected versions of this package are vulnerable to Improper Authentication in the authentication process when handling OIDC subject identifiers due to the use of an accent-insensitive collation in the database. An attacker can gain unauthorized access to another user's account by...
Budibase: Account Enumeration via Login Lockout Response Differential
Summary The login lockout mechanism in Budibase creates an observable response discrepancy that allows unauthenticated attackers to enumerate valid email addresses. When an existing user's account is locked after 5 failed login attempts, the server returns a distinct 403 response with...
Improper Neutralization of Special Elements in Data Query Logic
Overview @budibase/string-templates is a Handlebars wrapper for Budibase templating. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic in the enrichContext process. An attacker can gain unauthorized access to sensitive data, modify...
Improper Neutralization of Special Elements in Data Query Logic
Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic in the enrichContext process. An attacker can gain unauthorized access to sensitive data, modify or delete arbitrary documents, an...
Incorrect Authorization
Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Incorrect Authorization via the assign process. An attacker can gain unauthorized access to other applications and assign elevated roles to themselves or other users by exploiting insufficient...
CVE-2026-62835
Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network...
CVE-2026-62835
Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network...
EUVD-2026-48737
Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network...
CVE-2026-65710
sysPass through version 3.2.11 contains a missing authorization vulnerability that allows authenticated users with the PUBLICLINKCREATE profile flag to trigger unauthorized decryption and persistent storage of any vault account's password by exploiting the absence of AccountAcl checks in the publ...
GHSA-7R7X-GJVR-448G Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)
Open WebUI upload metadata can add files to knowledge bases without write permission Summary Open WebUI's file upload background processing trusts the client-supplied metadata.knowledgeid value and inserts a knowledgefile association before validating that the uploading user has write access to t...
EUVD-2026-42623
Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers ydoc:awareness:update, ydoc:document:leave...
CVE-2026-54765
A flaw was found in Traefik's Kubernetes Gateway API provider. An attacker capable of creating an accepted HTTPRoute that shares the same backend Service and port could exploit this vulnerability. The system may incorrectly apply the attacker's route filter context to another route's requests,...
CVE-2026-66027 Suna < 0.9.102 Broken Access Control via Message Queue API
Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that allows authenticated attackers to access and manipulate queue resources belonging to other users by exploiting missing ownership and account isolation checks. Attackers can read pending prompt queues ...
CVE-2026-8789
The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the eadeletemultipleconnections AJAX action in all versions up to, and including, 3.12.27. This makes it possible for authenticated...
OpenAI’s agent escaped its sandbox during a security test
During an internal OpenAI security evaluation, a chain of AI models escaped its sandbox, reached the internet, and then accessed Hugging Face infrastructure to complete the test objective. OpenAI is a leading artificial intelligence AI research and deployment company. Its best-known product is...
CVE-2026-54763
A flaw was found in Traefik, an HTTP reverse proxy and load balancer. The BasicAuth, DigestAuth, and ForwardAuth middlewares in Traefik do not correctly treat underscore-variant header names. This allows a remote attacker to inject a specially crafted header that bypasses Traefik's security...