2982 matches found
The vulnerability of the AI.Plugin.Azure software for vulnerability and error detection tools like PT Application Inspector arises from the lack of measures taken to neutralize special elements. This allows attackers to execute arbitrary commands.
The vulnerability of the AI.Plugin.Azure software patch, which is used for identifying vulnerabilities and errors in PT Application Inspector, stems from the lack of measures taken to neutralize its special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary...
SUSE SLED15: ImageMagick / ImageMagick-config-7-SUSE / etc (SUSE-SU-2026:3336-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3336-1 advisory. This update for ImageMagick fixes the following issue: - Extend CVE-2026-56379 patch by f63c78b bsc1268878. Tenable has...
CVE-2026-48060 Litestar: HTML Injection Through CSRF Token
Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie...
EUVD-2026-49991
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/web/session.go and internal/web/oidc.go set HttpOnly and SameSite=Lax on every cookie but never Secure. A single plaintext request to the origin operator on a LAN, mistyped...
ROOT-APP-NPM-CVE-2025-69873 CVE-2025-69873 in @rootio/ajv - Patched by Root
Root has patched CVE-2025-69873 in the @rootio/ajv package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-56761 CVE-2026-56761 in @rootio/hono - Patched by Root
Root has patched CVE-2026-56761 in the @rootio/hono package for Root:npm. Multiple fixed versions available...
EUVD-2026-49049
A flaw has been found in nanocoai NanoClaw up to 2.0.64. Affected is the function handleAddMcpServer of the file src/modules/self-mod/request.ts of the component addmcpserver. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has been...
CVE-2026-64419
CVE-2026-64419 is a Linux kernel vulnerability in the mm/shrinker subsystem. The function shrinker_debugfs_count_show() invokes a shrinker's ->count_objects() callback while holding an RCU read-side lock . The zswap shrinker's callback flushes memcg statistics via css_rstat_flush(), which may ...
SUSE CVE-2026-64231
In the Linux kernel, the following vulnerability has been resolved: drm/msm/dsi: don't dump registers past the mapped region On DSI 6G platforms the IO address space is internally adjusted by iooffset. Later this adjusted address might be used for memory dumping. However the size that is used for...
Camaleon-CMS---Authenticated-RCE-via-select_eval-Custom-Field
Security Advisory: Camaleon CMS - Authenticated RCE via selec...
CVE-2026-47708
CVE-2026-47708 (MCP-for-Stata) : Multiple sources describe a command-injection vulnerability in the log_file_name parameter used by the stata_do/stata-mcp wrapper. Prior to version 1.17.3, log_file_name is interpolated into a Stata command string without sanitization; the GuardValidator does not ...
CVE-2026-35198 HeyForm vulnerable to stored XSS via form field titles
HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting XSS vulnerability in the form builder allows a low-privileged team member to inject malicious JavaScript that executes when a team owner views the form, leading to complete account takeover through...
PT-2026-61617
HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, the /api/upload endpoint allows unauthenticated file uploads including SVG files. Uploaded SVGs are stored in the static assets directory and served with Content-Type: image/svg+xml by Express's serve-static middleware, allowing...
hplip security update
An update is available for hplip. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The hplip packages contain the Hewlett-Packard Linux Imaging and Printing...
ROOT-APP-NPM-CVE-2026-0621 CVE-2026-0621 in @rootio/modelcontextprotocol__sdk - Patched by Root
Root has patched CVE-2026-0621 in the @rootio/modelcontextprotocolsdk package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2025-1647 CVE-2025-1647 in @rootio/bootstrap - Patched by Root
Root has patched CVE-2025-1647 in the @rootio/bootstrap package for Root:npm. Multiple fixed versions available...
PYSEC-2026-2789 Open Babel has Use-after-free in GAMESS GAMESSOutputFormat::ReadMolecule
Summary A memory-safety vulnerability in Open Babel's GAMESS output parser caused a use-after-free when reading a crafted input file. Details The flaw was in GAMESSOutputFormat::ReadMolecule. A malformed input caused the parser to dereference a stale pointer after the underlying object had been...
PYSEC-2026-2687 OctoPrint has possible file exfiltration via query parameters on upload endpoints
Impact OctoPrint versions up until and including 1.11.7 as well as 2.0.0rc1 and 2.0.0rc2 contain a vulnerability that allows an attacker with the FILEUPLOAD permission to exfiltrate files from the host that OctoPrint has read access to, by moving them into the upload folder where they then can be...
PYSEC-2026-3046 RAGAS has SSRF via Multi-Modal Faithfulness Collections Module
A security flaw has been discovered in vibrantlabsai RAGAS up to 0.4.3. The affected element is the function tryprocesslocalfile/tryprocessurl of the file src/ragas/metrics/collections/multimodalfaithfulness/util.py of the component Collections Module. Performing a manipulation of the argument...