474536 matches found
[SECURITY] Fedora 45 Update: mstflint-4.36.0-4.fc45
This package contains firmware update tool, vpd dump and register dump tools for network adapters based on Mellanox Technologies chips...
EUVD-2026-91851
IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browser...
CVE-2026-104475
IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browser...
CVE-2026-104474
OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverified update packages from a nobody-writable directory as root. Attackers controlling the nobody web process can replace the package in /usr/local/lsws/autoupdate/ before extraction...
CVE-2026-104475: Improper Neutralization of Input During Web Page Generation
IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browser...
CVE-2026-104475 IDURAR ERP CRM through 4.1.1 Stored XSS via SVG Upload
IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browser...
CVE-2026-104475 IDURAR ERP CRM through 4.1.1 Stored XSS via SVG Upload
IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browser...
CVE-2026-104475 IDURAR ERP CRM through 4.1.1 Stored XSS via SVG Upload
IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browser...
CVE-2026-104475
IDURAR ERP CRM, versions through 4.1.1 , is vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is the application's failure to sanitize SVG files during the upload process. Authenticated users can exploit this by uploading JavaScript-laden SVGs via the profile update or settin...
CVE-2026-104873 LangGraph SDK custom auth silently ignores actions= on resource decorators
LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From 0.1.45 until 0.4.4, the langgraph-sdk resource-scoped authorization decorators @auth.on.threads, @auth.on.assistants, and @auth.on.crons ignore the...
CVE-2026-104873 LangGraph SDK custom auth silently ignores actions= on resource decorators
LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From 0.1.45 until 0.4.4, the langgraph-sdk resource-scoped authorization decorators @auth.on.threads, @auth.on.assistants, and @auth.on.crons ignore the...
CVE-2026-104873
The LangGraph Python SDK is vulnerable to an authorization bypass in versions 0.1.45 through 0.4.3 . The root cause is that resource-scoped authorization decorators (@auth.on.threads , @auth.on.assistants , and @auth.on.crons ) ignore the actions argument, registering handlers for every action on...
CLSA-2026-1790963665 TuxCare security update for js-yaml (5 CVEs)
TuxCare rebuilt js-yaml to address 5 CVEs. Fixed in 3.13.1-tuxcare.1...
CLSA-2026-1790963499 TuxCare security update for tar-fs (3 CVEs)
TuxCare rebuilt tar-fs to address 3 CVEs. Fixed in 2.1.1-tuxcare.1...
CLSA-2026-1790957410 TuxCare security update for org.springframework.security (1 CVE)
TuxCare rebuilt 19 org.springframework.security packages to address 1 CVE. Fixed in 6.2.7-tuxcare.6...
CLSA-2026-1790947292 TuxCare security update for org.springframework.security (1 CVE)
TuxCare rebuilt 21 org.springframework.security packages to address 1 CVE. Fixed in 5.7.12-tuxcare.10...
CVE-2026-104445
YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the verified HTTP signature signer to the activity actor. Unauthenticated attackers with any ActivityPub keypair can send signed Delete or Update activities referencing a mirrored...
CVE-2026-104445 YesWiki before 4.6.7 Authentication Bypass via ActivityPub Inbox Actor Spoofing
YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the verified HTTP signature signer to the activity actor. Unauthenticated attackers with any ActivityPub keypair can send signed Delete or Update activities referencing a mirrored...
CVE-2026-104445 YesWiki before 4.6.7 Authentication Bypass via ActivityPub Inbox Actor Spoofing
YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the verified HTTP signature signer to the activity actor. Unauthenticated attackers with any ActivityPub keypair can send signed Delete or Update activities referencing a mirrored...
CVE-2026-104445 YesWiki before 4.6.7 Authentication Bypass via ActivityPub Inbox Actor Spoofing
YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the verified HTTP signature signer to the activity actor. Unauthenticated attackers with any ActivityPub keypair can send signed Delete or Update activities referencing a mirrored...