207774 matches found
EUVD-2026-87284
GLPI is a free asset and IT management software package. From 10.0.0 until 10.0.26 and 11.0.8, any logged-in GLPI user can exploit insufficient path validation in the profile-picture update flow to request deletion of an attacker-selected file hosted by the server. This issue is fixed in versions...
CVE-2026-47679 GLPI: arbitrary file deletion
GLPI is a free asset and IT management software package. From 10.0.0 until 10.0.26 and 11.0.8, any logged-in GLPI user can exploit insufficient path validation in the profile-picture update flow to request deletion of an attacker-selected file hosted by the server. This issue is fixed in versions...
ethibench
From Controlled to the Wild: Evaluation of Pentesting Agents in the Real-World AI pentesting agents are increasingly credible as offensive security systems, but current benchmarks still provide limited guidance on which systems will perform best on real-world targets. Most existing evaluations...
CVE-2026-47834
A flaw was found in Spring Data JPA. This vulnerability allows a remote attacker to bypass data validation mechanisms by submitting specially crafted input. This could lead to unauthorized access to limited information and minor disruptions in service availability. Mitigation There is no mitigati...
CVE-2026-56724
The web-based open source helpdesk system Zammad is vulnerable to a permission check flaw in the knowledge base management area prior to version 7.0.2 . Due to incomplete data validation for linked items, users with limited read permissions could potentially interact with items outside their assi...
EUVD-2026-87203
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary An issue with permission checks in the knowledge base management area has been identified. Under certain conditions, data validation for linked items was not fully enforced. This could have allowed users...
CVE-2026-56724 Zammad: Incorrect implementation of permission checks in the knowledge base module
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary An issue with permission checks in the knowledge base management area has been identified. Under certain conditions, data validation for linked items was not fully enforced. This could have allowed users...
Security Bulletin: The Pre-Validation App for IBM QRadar SIEM contains components with known vulnerabilities
Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Pre-Validation App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-33750 DESCRIPTION: The...
CVE-2026-85289 InvoicePlane: Missing CSRF Token Validation on Multiple Delete Endpoints
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane omits ensurevalidpostrequest from delete methods including Payments::delete, Recurring::delete, and Userclients::delete. Although the routes require POST, they do not...
CVE-2026-85289
The open-source application InvoicePlane (prior to version 1.7.2) is vulnerable to Cross-Site Request Forgery (CSRF) due to missing CSRF token validation on specific delete methods. Specifically, the Payments::delete(), Recurring::delete(), and User_clients::delete() functions omit the ensure_val...
BIT-PARSE-2026-66009 Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages
Parse Server versions = 9.0.0 before 9.10.0 and = 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled graphQLPublicIntrospection: false, the default. A client holding only the public application id — with n...
SUSE-SU-2026:4350-1 Security update for gnome-shell
This update for gnome-shell fixes the following issue: - CVE-2026-91786: missing dimension validation when processing icons from a remote search provider via D-Bus can lead to an out-of-bounds read bsc1280619...
Chromium CVE-2026-95364: Improper input validation in Passwords
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium CVE-2026-95341: Improper input validation in Desktop
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium CVE-2026-95330: Improper state validation in Downloads
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium CVE-2026-95382: Improper input validation in Auth
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium CVE-2026-95276: Improper input validation in Themes
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium CVE-2026-95381: Improper input validation in Printing
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
CVE-2026-100187
The Onion module in the AIL Framework is vulnerable to a logic flaw in its URL extraction process. The software uses a performance shortcut that validates .onion targets based only on a 69-character length and a ".onion" suffix , failing to perform proper hostname parsing or domain validation. An...
CVE-2026-100187 AIL Framework Onion Module: Non-Onion URL Accepted as Crawler Task Due to Bypassed Domain Validation
The Onion module in AIL Framework contained a performance shortcut in its URL extraction logic that accepted URLs as valid .onion targets based solely on a length check exactly 69 characters and a suffix check ending in ".onion", without performing proper hostname parsing or onion-domain...