589 matches found
CVE-2026-5423
The CVE affects @neo4j/graphql library prior to 7.5.6 (and 7.5.x) where a pre-decoded JWT passed via GraphQL subscription connectionParams is not verified, allowing unauthenticated clients to forge JWT claims and trigger @authentication/@subscriptionsAuthorization checks to receive restricted sub...
ROOT-OS-UBUNTU-2404-CVE-2025-39961 CVE-2025-39961 in linux - Patched by Root
Root has patched CVE-2025-39961 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available...
ROOT-OS-UBUNTU-2204-CVE-2025-39898 CVE-2025-39898 in linux - Patched by Root
Root has patched CVE-2025-39898 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available...
ROOT-OS-UBUNTU-2204-CVE-2022-50322 CVE-2022-50322 in linux - Patched by Root
Root has patched CVE-2022-50322 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available...
ROOT-OS-UBUNTU-2204-CVE-2024-46820 CVE-2024-46820 in linux - Patched by Root
Root has patched CVE-2024-46820 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available...
ROOT-OS-UBUNTU-2204-CVE-2026-53001 CVE-2026-53001 in linux - Patched by Root
Root has patched CVE-2026-53001 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available...
ROOT-OS-DEBIAN-12-CVE-2025-39931 CVE-2025-39931 in linux - Patched by Root
Root has patched CVE-2025-39931 in the linux package for Root:Debian:12. Multiple fixed versions available...
EUVD-2026-53445
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0, when a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession...
EUVD-2026-53436
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1, shell.openPath did not reject paths containing embedded null bytes. Apps that perform string-only validation of file paths, for example...
CVE-2026-17578
Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation before reaching NIST SP 800-38D recommended usage limit for AES-GCM encryption keys with random nonces when the AWS IAM encryption feature is enabled. If a producer sends messages at a sustained high rate withou...
CVE-2026-68945 Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same...
CVE-2026-45330
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin controllers load pending Authorization records by raw identifier without confirming currentorganization ownership, allowing an...
CVE-2026-45377 Decidim: Private exports can be downloaded through reusable links
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal downloadyourdata flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without...
SUSE CVE-2026-55075
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, two flaws in Coder's OIDC login chained into account takeover. Email-based user matching fell back to linking by email without checking for an existing link...
SUSE CVE-2026-55438
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, Coder's subdomain-based workspace app proxy allowed the same-owner CORS check to be bypassed. When a workspace-name subdomain segment parsed as a UUID, the...
PT-2026-66607
Name of the Vulnerable Software and Affected Versions Sylius Mollie Plugin versions prior to 2.2.8 Sylius Mollie Plugin versions prior to 3.2.4 Sylius Mollie Plugin versions prior to 3.3.1 Description The software fails to perform ownership or session checks when looking up sequential orderId...
CVE-2026-16729 undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields
undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized, so attacker-influenced input can...
GHSA-WFP6-F47H-HXC3 AWS CLI: Overly permissive File Permissions
Summary The AWS Command Line Interface AWS CLI is a unified tool for managing AWS services from the command line. Certain CLI subcommands wrote credential and configuration files with world-readable permissions on Unix-like systems with a default umask, allowing other local users on the same host...
CVE-2026-56746
Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit...