4046 matches found
CVE-2026-72835 filebrowser before v2.63.21 Access Rule Bypass via Path Canonicalization
filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can request files with alternate path representations that match no ru...
GO-2026-6003 vulnerabilities
Vulnerabilities for packages: datadog-agent-fips, tigera-operator-fips, tigera-operator, gitlab-operator, datadog-agent, gitlab-operator-fips...
CVE-2026-58428
Release attachment extension allowlist bypass via web release edit form variant of CVE-2025-68939...
CVE-2026-58428 Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
Release attachment extension allowlist bypass via web release edit form variant of CVE-2025-68939...
CVE-2026-58428
CVE-2026-58428 : Release attachment extension allowlist bypass via the web release edit form in Gitea (variant of CVE-2025-68939). Connected sources confirm the issue and cite a fix in the Gitea 1.27.0 release tag. The initial documents do not specify exact affected versions or root cause details...
EUVD-2026-58156
Release attachment extension allowlist bypass via web release edit form variant of CVE-2025-68939...
MAL-2026-12776 Malicious code in devplatform-spa-plugin-root-sentry (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a5ac277cf4ba72cf1040b5e06d6875a7228d7ec491d93423198e2b2f92ecb6a Package presents as a Sentry-related SPA plugin but the exported class is an empty stub; index.js requires bootstrap.js, which on load selects a...
Malicious code in sme-scripts-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b75dc70e9ee97206f0c177de615ca37ed1611752e645127bc6961e5d753f61f On require'sme-scripts-cli', index.js loads bridge.js which detects OS/architecture, downloads an OS-specific binary from hardcoded Cloudflare...
MAL-2026-12259 Malicious code in tinkoff-statist-browser-typed-client-eventea.projects.finhealthwebmicroblocks (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d381f80d9b2d3b310ab426d3c51996861b4c320f2926e53ea078da80e832a07 On require of this package, index.js loads vendor.js which downloads a platform-specific binary from runtime-assembled Cloudflare Workers hostnames...
mingw-glib2 security update
2.70.1-9 - Fix CVE-2026-58010: off-by-one error in gvstupleisnormal Resolves: RHEL-212164 2.70.1-8 - Fix CVE-2026-58011: gdatetimeaddfull range validation Resolves: RHEL-212184 2.70.1-7 - Fix CVE-2026-58013: memcmp buffer over-read in giochannel Resolves: RHEL-212234 2.70.1-6 - Fix CVE-2026-58012...
Improper Input Validation
Overview Affected versions of this package are vulnerable to Improper Input Validation in the calculateAgreementpub, message method of the DHAgreement class, which raises the peer-supplied message to the power of the local static private key x without any range or subgroup-membership check, while...
Improper Input Validation
Overview org.bouncycastle:bcprov-debug-jdk15on is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Input Validation in the calculateAgreementpub, message method of the DHAgreement class, which raises the peer-supplied message to the...
Improper Input Validation
Overview Affected versions of this package are vulnerable to Improper Input Validation in the calculateAgreementpub, message method of the DHAgreement class, which raises the peer-supplied message to the power of the local static private key x without any range or subgroup-membership check, while...
Improper Input Validation
Overview Affected versions of this package are vulnerable to Improper Input Validation in the calculateAgreementpub, message method of the DHAgreement class, which raises the peer-supplied message to the power of the local static private key x without any range or subgroup-membership check, while...
glib: GLib: Buffer underflow in GVariant parser leads to heap corruption
A flaw was found in GLib Gnome Lib. This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser when processing maliciously crafted input strings...
EUVD-2026-52031
In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affects Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 2.0.13...
CVE-2026-59643 OpenPGP inline-signature policy failures silently ignored
In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affects Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 2.0.13...
CVE-2026-59648
CVE-2026-59648 affects Bouncy Castle for Java: OpenPGP Argon2 S2K accepts attacker-chosen memory parameters. Vulnerable in BC Java before 1.85, in BC Java LTS before 2.73.12, and in BC Java FIPS (bcpg-fips) before 1.0.13 (1.0.x), 2.0.13 (2.0.x), and 2.1.13 (2.1.x). Per NVD, CVSSv4.0 base score 6....
CVE-2026-65423
A flaw was found in open62541. An integer overflow in the UAVariant arrayDimensions product computation may allow a remote attacker to trigger an out-of-bounds write. This could lead to arbitrary code execution or a denial of service DoS...