3220 matches found
CVE-2026-121967
Coder 2.28.0 before 2.29.22, 2.30.0 before 2.34.13, 2.35.0 before 2.35.10, 2.36.0 before 2.36.8, 2.37.0 before 2.37.5, and 2.38.0 before 2.38.1 contains a path traversal vulnerability in the AI Gateway passthrough router, which forwards percent-encoded dot segments upstream without rejecting them...
CVE-2026-105296
Multiple Akeeba products lack the anti-CSRF check on some actions. If the user access a malicious page while logged into the product, unintended operations may be performed...
EUVD-2026-116707
Multiple Akeeba products lack the anti-CSRF check on some actions. If the user access a malicious page while logged into the product, unintended operations may be performed...
CVE-2026-105296
Multiple Akeeba products are vulnerable to Cross-Site Request Forgery (CSRF) because they lack anti-CSRF checks on certain actions. An attacker could perform unintended operations if a logged-in user visits a malicious webpage. No specific exploit information or remediation steps are provided in ...
CVE-2026-120567
The MongoDB Entity Framework Core provider does not neutralize special elements in values passed to SetProperty when an ExecuteUpdate call also contains a setter that reads the entity being updated. In that case the update is sent as an aggregation pipeline, and a caller-supplied string beginning...
CVE-2026-120567 EF Core provider: pipeline-form ExecuteUpdate evaluates a user string setter as a $-field reference
The MongoDB Entity Framework Core provider does not neutralize special elements in values passed to SetProperty when an ExecuteUpdate call also contains a setter that reads the entity being updated. In that case the update is sent as an aggregation pipeline, and a caller-supplied string beginning...
CVE-2026-120567
The MongoDB Entity Framework Core provider contains a vulnerability where it fails to neutralize special elements in caller-supplied values during bulk updates expressed as database results. Because the provider does not properly sanitize these values, input supplied as plain data can be misinter...
PT-2026-136125
Name of the Vulnerable Software and Affected Versions mongoDB Node.js driver affected versions not specified Description A flaw in the connection management layer allows a pooled network connection to be returned to the pool for reuse while data from a previous operation is still outstanding. Whe...
CVE-2026-120567: MongoDB Entity Framework Core Provider: The MongoDB Entity Framework Core provider does not neutralize special elements when it places a caller-supplied valueā¦
The MongoDB Entity Framework Core provider does not neutralize special elements when it places a caller-supplied value into a bulk update that is expressed as a databasea result, a value supplied as plain data may be interpreted by the database as expression syntax. A part value through normal...
CLEANSTART-2026-ZG57925 vulnerability in Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker t...
Security vulnerability affects the apache-nifi package. A vulnerability in Spring Expression Language SpEL evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker to invoke unintended application logic...
CVE-2025-492025
CVE-2025-492025 Security Advisory: CVE-2025-492025 Summary A vulnerability has been identified in Copilot AI that causes an unintended hyperlink to be included in the "link source" section whenever Copilot retrieves a web query. This issue resulted in users clicking on links to...
CVE-2026-21012-Rust-serde-Deserialization-of-Untrusted-Enum-Variant-Injection-
CVE-2026-21012 ā Rust serde Deserialization of Untrusted Enum Variant Injection Program Code Rust // serdevuln.rs - Deserializes an enum from user JSON without validation use serde::Deserialize, Serialize; use serdejson; deriveDeserialize, Debug enum AdminAction ReadLogs, DeleteUserString,...
EUVD-2026-113915
CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator. createRxValidator is documented to anchor the supplied pattern at both ends, but builds /^$rx$/ without grouping the pattern. An alternation such as yes|no then accepts any value...
CVE-2025-492026
Security Advisory: CVE-2025-492026 Summary A vulnerability has been identified in Copilot AI that causes an unintended hyperlink to be included in the "link source" section whenever Copilot retrieves a web query. This issue resulted in users clicking on links to https://www.collectingflags.com ev...
CVE-2025-32462-32463-Detection-Script-
CVE-2025-32462-32463-Detection-Script- Critical Sudo Vulnerabilities Let Local Users Gain Root Access on Linux, Impacting Major Distros A brief description of the vulnerabilities is below - CVE-2025-32462 CVSS score: 2.8 - Sudo before 1.9.17p1, when used with a sudoers file that specifies a host...
CLEANSTART-2026-BE67528 vulnerability in Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker t...
Security vulnerability affects the apache-hive package. A vulnerability in Spring Expression Language SpEL evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker to invoke unintended application logic...
PT-2026-133536
CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator. createRxValidator is documented to anchor the supplied pattern at both ends, but builds /^$rx$/ without grouping the pattern. An alternation such as yes|no then accepts any value...
CVE-2025-3082
A user authorized to access a view may be able to alter the intended collation, allowing them to access to a different or unintended view of underlying data. This issue affects MongoDB Server v5.0 version prior to 5.0.31, MongoDB Server v6.0 version prior to 6.0.20, MongoDB Server v7.0 version...
CVE-2026-114726
A flaw was found in Roundcube Webmail. This vulnerability allows a remote attacker to inject arbitrary email headers by sending an email containing encoded carriage return and line feed CRLF control characters within the sender display name. When an affected user bounces or resends the message, t...
Linux Distros Unpatched Vulnerability : CVE-2026-118581
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of t...