CVE-2024-7952

Rockwell Automation's DataMosaix Private Cloud (versions 7.07 and prior ) is affected by a data exposure vulnerability (CWE-200). Hardcoded links in the source code point to JSON files that are accessible without authentication, allowing an unauthenticated remote attacker to view customer data. T...

CVE-2026-19592

OpenAI Codex CLI (v0.102.0–0.130.0) and Codex Desktop (Windows and macOS) executed a repository-supplied core.fsmonitor helper during background Git metadata collection, outside the command sandbox and without a user-approval prompt. An attacker who delivers a repository with its .git/config inta...

CVE-2026-19593

OpenAI Codex Desktop for Windows and macOS automatically inspects Git metadata when a workspace is opened. If the repository contains an attacker-controlled .git/config with the attr.tree setting and a configured clean or process filter, Git executes an attacker-controlled program outside Codex's...

CVE-2026-19591

OpenAI Codex CLI (Windows, macOS, Linux) and Codex Desktop (Windows, macOS) contain an approval-bypass flaw in their command-safety parser. The parser misinterprets PowerShell's stop-parsing token (--%), classifying certain commands as safe when they are not. An attacker who controls a repository...

CVE-2026-19590

OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because its automated Git operations trusted the repository-local core.hooksPath setting in .git/config. If a user opens a crafted repository where this setting points to an attacker-controlled directory, a mal...

CVE-2020-158581

CVE-2020-158581 is a reserved CVE entry with no public technical details currently available. The assigning organization has not yet announced the associated security problem. Action: monitor for updates when details are published.

CVE-2026-58566

CVE-2026-58566 is an Incorrect Authorization vulnerability in Dell PowerStore . A low-privileged attacker with remote network access could exploit it to achieve elevation of privileges , with a CVSS 3.1 base score of 8.8 (HIGH) — indicating high impact to confidentiality, integrity, and availabil...

CVE-2026-61769

NVIDIA Megatron Bridge is affected by a deserialization of untrusted data vulnerability (CVE-2026-61769). An attacker with local access and low privileges (no user interaction required) can trigger the flaw, potentially leading to code execution , data tampering , and information disclosure . The...

CVE-2026-61777

NVIDIA Megatron Bridge is vulnerable to deserialization of untrusted data , which an attacker can exploit to achieve code execution , data tampering , and information disclosure . The assigned CVSS 3.1 score is 7.8 (HIGH) with a local attack vector , low complexity , and low privileges required ,...

CVE-2026-61778

NVIDIA Megatron Bridge is affected by a deserialization of untrusted data vulnerability (CVE-2026-61778). An attacker with local access and low privileges, requiring no user interaction, could trigger the deserialization flaw, potentially leading to code execution, data tampering, and information...

CVE-2026-61779

NVIDIA Megatron Bridge is affected by a deserialization of untrusted data vulnerability that could allow an attacker to achieve code execution , data tampering , and information disclosure . The CVSS 3.1 score is 7.8 (HIGH) , with a local attack vector , low complexity , and low privileges requir...

CVE-2026-61770

NVIDIA Megatron Bridge is affected by a deserialization of untrusted data vulnerability. A local attacker with low privileges (no user interaction required) could exploit this to achieve code execution, data tampering, and information disclosure , with high impact on confidentiality, integrity, a...

CVE-2026-61771

NVIDIA Megatron Bridge is affected by a deserialization of untrusted data vulnerability (CVE-2026-61771). A successful exploit could lead to code execution, data tampering, and information disclosure . The CVSS v3.1 score is 7.8 (HIGH) with a local attack vector, low privileges required, and no u...

CVE-2026-61772

NVIDIA Megatron Bridge is affected by a deserialization of untrusted data vulnerability that could allow an attacker with local access and low privileges to achieve code execution, data tampering, and information disclosure . The assigned CVSS 3.1 score is 7.8 (HIGH) , with a local attack vector,...

CVE-2026-61773

NVIDIA Megatron Bridge is affected by a deserialization of untrusted data vulnerability. A successful exploit could lead to code execution, data tampering, and information disclosure . The assigned CVSS v3.1 score is 7.8 (HIGH) with a local attack vector , low complexity, and low privileges requi...

CVE-2026-61774

NVIDIA Megatron Bridge is affected by a deserialization of untrusted data vulnerability. A successful exploit could lead to code execution , data tampering , and information disclosure . The CVSS v3.1 score is 7.8 (HIGH) , with a local attack vector, low privileges required, and no user interacti...

CVE-2026-61775

NVIDIA Megatron Bridge is affected by a deserialization of untrusted data vulnerability. A successful exploit could lead to code execution, data tampering, and information disclosure . The CVSS v3.1 base score is 7.8 (HIGH) with a local attack vector, low complexity, and low privileges required, ...

CVE-2026-61776

NVIDIA Megatron Bridge is affected by a deserialization of untrusted data vulnerability. A successful exploit could result in code execution, data tampering, and information disclosure . The assigned CVSS 3.1 score is 7.8 (HIGH) , with a local attack vector , low complexity , low privileges requi...

CVE-2026-61766

NVIDIA Megatron Bridge is affected by a deserialization of untrusted data vulnerability. A successful exploit could lead to code execution , data tampering , and information disclosure . The assigned CVSS 3.1 score is 7.8 (HIGH) with a local attack vector, low complexity, and low privileges requi...

CVE-2026-61767

NVIDIA Megatron Bridge is vulnerable to deserialization of untrusted data , which could allow an attacker to achieve code execution, data tampering, and information disclosure . The vulnerability has a CVSS 3.1 base score of 7.8 (HIGH) with a local attack vector, low complexity, low privileges re...

CVE-2026-61768

NVIDIA Megatron Bridge is affected by a vulnerability where an attacker could cause deserialization of untrusted data . A successful exploit may lead to code execution, data tampering, and information disclosure . The CVSS 3.1 base score is 7.8 (HIGH) , with a local attack vector, low complexity,...

CVE-2026-61760

CVE-2026-61760 is a deserialization of untrusted data vulnerability (CWE-502) in NVIDIA Megatron Bridge , affecting versions 0.0 through 0.5.0 on all platforms. A successful local exploit with low privileges required could result in code execution, data tampering, and information disclosure , wit...

CVE-2026-61761

CVE-2026-61761 is one of 30 deserialization-of-untrusted-data flaws (CWE-502) in NVIDIA Megatron Bridge , an open-source framework for large-scale model training. The vulnerability requires local access with low privileges and no user interaction , yet can lead to code execution, data tampering, ...

CVE-2026-61762

NVIDIA Megatron Bridge (versions 0.0 to 0.5.0) is vulnerable to deserialization of untrusted data (CWE-502). An attacker with local access and low privileges can exploit this to achieve code execution, data tampering, and information disclosure , rated CVSS 7.8 (HIGH) . The vulnerability affects ...

CVE-2026-61763

NVIDIA Megatron Bridge versions 0.0 through 0.5.0 are affected by a deserialization of untrusted data vulnerability (CWE-502). A local attacker with low privileges can exploit this without user interaction to achieve code execution, data tampering, and information disclosure , rated CVSS 7.8 (HIG...

CVE-2026-61764

CVE-2026-61764 is a deserialization of untrusted data vulnerability (CWE-502 ) in NVIDIA Megatron Bridge , affecting versions 0.0 through 0.5.0 on all platforms. A successful local exploit (low complexity, low privileges required) could lead to code execution, data tampering, and information disc...

CVE-2026-61765

NVIDIA Megatron Bridge is affected by a deserialization of untrusted data vulnerability. An attacker with local access and low privileges (no user interaction required) could exploit this to achieve code execution , data tampering , and information disclosure . The vulnerability carries a CVSS 3....

CVE-2026-61759

NVIDIA Megatron Bridge versions 0.0 through 0.5.0 (all platforms) are affected by a deserialization of untrusted data flaw (CWE-502). A local attacker with low privileges can exploit it to achieve code execution, data tampering, and information disclosure , rated CVSS 7.8 (HIGH) . This is one of ...

CVE-2026-61750

NVIDIA Megatron Bridge is vulnerable to deserialization of untrusted data (CWE-502) . An attacker with local access and low privileges (no user interaction required) can trigger the flaw, potentially leading to code execution, data tampering, and information disclosure . The CVSS v3.1 base score ...

CVE-2026-61751

CVE-2026-61751 affects NVIDIA Megatron Bridge (versions 0.0 through 0.5.0, all platforms). The root cause is deserialization of untrusted data (CWE-502), which a local attacker with low privileges and no user interaction can exploit to achieve code execution, data tampering, and information discl...

CVE-2026-61752

NVIDIA Megatron Bridge (versions 0.0 to 0.5.0) is affected by a deserialization of untrusted data vulnerability (CWE-502). A local attacker with low privileges and no user interaction could exploit this to achieve code execution, data tampering, and information disclosure , rated CVSS 7.8 (HIGH) ...

CVE-2026-61753

NVIDIA Megatron Bridge is affected by a vulnerability allowing an attacker to cause deserialization of untrusted data , which could lead to code execution, data tampering, and information disclosure . The connected NVIDIA security bulletin classifies this specific CVE under CWE-22 (Path Traversal...

CVE-2026-61754

CVE-2026-61754 affects NVIDIA Megatron Bridge (versions 0.0 through 0.5.0 , all platforms). The root cause is deserialization of untrusted data (CWE-502), allowing a local attacker with low privileges to achieve code execution, data tampering, and information disclosure . The CVSS v3.1 score is 7...

CVE-2026-61758

CVE-2026-61758 affects NVIDIA Megatron Bridge (versions 0.0 to 0.5.0 , all platforms). The root cause is deserialization of untrusted data (CWE-502), allowing a local attacker with low privileges to achieve code execution, data tampering, and information disclosure . The vulnerability is scored C...

CVE-2026-61755

CVE-2026-61755 affects NVIDIA Megatron Bridge versions 0.0 through 0.5.0 across all platforms. The root cause is a deserialization of untrusted data flaw (CWE-502), part of a batch of 30 related CVEs disclosed in NVIDIA's September 2026 security bulletin. A successful local exploit requires low p...

CVE-2026-61756

NVIDIA Megatron Bridge (versions 0.0 to 0.5.0) is affected by a deserialization of untrusted data vulnerability (CWE-502). A local attacker with low privileges and no user interaction can exploit this to achieve code execution, data tampering, and information disclosure . The CVSS 3.1 score is 7....

CVE-2026-61757

NVIDIA Megatron Bridge versions 0.0 through 0.5.0 contain a deserialization of untrusted data vulnerability (CWE-502) rated HIGH (CVSS 7.8) . A local attacker with low privileges and no user interaction could exploit this to achieve code execution, data tampering, and information disclosure . The...

CVE-2026-79687

Dell PowerStore SDNAS contains a Missing Authentication for Critical Function vulnerability (CVE-2026-79687). An unauthenticated attacker with remote network access could exploit the flaw to obtain filesystem access , with a changed scope and High impact on confidentiality, integrity, and availab...

CVE-2026-58567

Dell PowerStore is affected by an OS Command Injection vulnerability that allows an authenticated user with limited privileges to execute arbitrary commands with root privileges . The CVSS 3.1 score is 8.8 (HIGH) , with a local attack vector, low complexity, low privileges required, changed scope...

CVE-2026-49329

A flaw in openshift/oauth-server allows an unauthenticated attacker to trigger a quadratic-time denial of service by sending a crafted Accept-Language header using '_' separators to the OAuth login and error page endpoints. The root cause is a bypass of the CVE-2022-32149 mitigation : the upstrea...

CVE-2026-10195

FS-Poster WordPress plugin (versions up to and including 8.0.1 ) is vulnerable to authenticated remote code execution via insufficient sanitization of the FFmpeg path parameter before it is passed to the exec() function, combined with missing authorization checks on REST API endpoints. Attackers ...

CVE-2026-79682

Dell PowerStore is affected by a Command Injection vulnerability that allows an authenticated user with limited privileges to execute arbitrary commands with root privileges . The CVSS 3.1 score is 8.8 (HIGH) with a local attack vector, low complexity, and changed scope, resulting in high impact ...

CVE-2026-84270

The affected software is gvfs (GNOME Virtual Filesystem), specifically its MTP backend . The flaw resides in do_read() within gvfsbackendmtp.c , which trusts the data length returned by a connected MTP device without capping it to the size originally requested by the client. When a malicious devi...

CVE-2026-84269

A heap-based buffer overflow was identified in the AFP backend of gvfs . When mounting a share, a malicious AFP server can supply a length in the DSI read path that exceeds the size the client requested. Because the function does not validate the server-provided length against the pre-sized reply...

CVE-2026-84267

CVE-2026-84267 is an uninitialized heap memory disclosure in the SFTP backend of gvfs (GNOME Virtual File System). The root cause is in the read_string() function, which allocates a buffer without verifying it is fully populated. A malicious SFTP server can send a short FXP_HANDLE reply, causing ...

CVE-2026-84207

Heym before 0.0.98 is affected by a Server-Side Request Forgery (SSRF) vulnerability in its WebSocket Send and WebSocket Trigger workflow nodes. The root cause is the failure to apply SSRF egress guards to these nodes, allowing authenticated users to craft workflow nodes with arbitrary URLs and h...

CVE-2026-84206

Snipe-IT before 8.7.0 contains an authorization bypass in the bulk asset restore endpoint , which is gated on the assets.edit permission instead of the intended assets.delete permission. This allows authenticated users with only edit rights to restore soft-deleted assets by posting asset identifi...

CVE-2026-84205

GROWI through 8.0.2 contains an authorization bypass in the GET /_api/v3/revisions/:id endpoint. The vulnerability arises because the endpoint validates access using a query parameter but returns the revision identified by the path parameter without confirming both reference the same page. An aut...

CVE-2026-84232

CVE-2026-84232 is a stored cross-site scripting (XSS) vulnerability in pulpcore's content serving application (python-pulpcore). The root cause is that files uploaded to Pulp file-type repositories are served with their original MIME type (e.g., text/html, image/svg+xml) and without a Content-Dis...

CVE-2026-84203

Memos versions 0.26.0 through 0.30.0 contain an insufficient session expiration flaw: refresh tokens are not revoked when a user changes their password. An attacker holding a stolen refresh token can call the RefreshToken RPC to mint new access tokens and rotate the refresh token indefinitely, ef...