401041 matches found
CVE-2026-82837
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that certain conditions could have allowed an authenticated user to access sensitive credentials and tokens without transiting the expected proxy due to...
CVE-2026-81899
Concrete CMS 9.0.0 to 9.5.2 stored group folder names without sanitization and printed them unescaped on the Members Groups dashboard page, resulting in stored cross-site scripting. The add and edit group-folder handlers stored the submitted folder name without neutralizing HTML, and the group...
CVE-2026-81898
In Concrete CMS below version 9.5.3, the Address attribute's country-less text formatter skipped HTML-escaping, enabling stored XSS in Express association views. A user able to submit an Address attribute could execute script in the session of any dashboard user who opened the affected entry. The...
CVE-2026-81236
Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...
CVE-2026-81240
Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...
CVE-2026-81237
Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...
CVE-2026-81235
Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain a Missing Cryptographic Step vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering...
CVE-2026-81239
Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...
CVE-2026-81238
Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...
CVE-2026-61668
DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, WorkloadManagementSystem/Utilities/PilotWrapper.py pilotWrapperScript uses ssl.createunverifiedcontext to download the second-stage pilot.tar archive without TLS certificat...
CVE-2026-61667
DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, DataManagementSystem/Service/FileCatalogHandler.py checkDataset forwards an authenticated caller-controlled datasets value to DatasetManager.py checkDataset, where...
CVE-2026-58485
mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.7.1, weburlread receives its caller-controlled URL through src/index.ts and validates only the literal hostname in assertUrlAllowed within src/url-reader.ts...
CVE-2026-58502
githubtoplanguages generates a user's top GitHub languages as an SVG. The .github/workflows/discord-issue.yml workflow runs when an issue is opened or closed and interpolates github.event.issue.title directly into the Bash assignment for ISSUETITLE before shell parsing. An issue title containing...
CVE-2026-57442
MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault. Prior to 0.11.5, PathFilter in src/pathfilter.ts uses root-anchored deny-list patterns, so nested .git, .obsidian, and nodemodules path segments do not match the restriction and pass both...
CVE-2026-56831
Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.0, the /cpanel/discounts administrative interface accepts negative fixedamount discount values, persists them in shdiscounts, and passes them through vendor/shopper/cart/src/Discounts/DiscountCalculator.php and...
CVE-2026-58483
mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.7.1, weburlread in src/index.ts passes a caller-supplied URL to readUrlContent in src/url-reader.ts, where checkContentLength treats a missing Content-Length...
CVE-2026-56830
Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store in packages/admin/src/Livewire/Components/Products/Form/Media.php without the editproducts authorization check used by sibling sub-forms. An authenticated staff user with...
CVE-2026-57441
MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault. Prior to 0.11.4, PathFilter in src/pathfilter.ts compiles restricted-directory patterns case-sensitively and compares paths without canonicalizing filesystem-equivalent segment names. On...
CVE-2026-56829
Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Products/VariantStock.php exposes stockAction without editproductvariants authorization and leaves public $variant client mutable because it lacks the Livewire Locked attribute. Any authenticated...
CVE-2026-56825
Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Collection/CollectionProducts.php exposes Action::make'delete' and DeleteBulkAction::make without deletecollections authorization, while public Collection $collection remains client mutable becaus...
CVE-2026-56827
Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, groupedBulkActions in packages/admin/src/Livewire/Pages/Attribute/Browse.php, packages/admin/src/Livewire/Pages/Tag/Index.php, packages/admin/src/Livewire/Pages/Brand/Index.php, packages/admin/src/Livewire/Pages/Category/Index.php, and...
CVE-2026-55375
canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams places appid, appsecret, refreshtoken, and code in the URL query string of token POST requests, allowing access logs, proxy logs, and APM traces to persist the credential...
CVE-2026-55225
Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and earlier, an attacker who can create a Kafka custom resource can set Kafka.spec.entityOperator watchedNamespace to a target namespace, causing the Cluster...
CVE-2026-54549
Meta Ads MCP is a Model Context Protocol MCP server that lets AI assistants run Meta Ads. Prior to version 1.0.115, the uploadadimage tool in metaadsmcp/core/ads.py passes an attacker-controlled imageurl to trymultipledownloadmethods in metaadsmcp/core/utils.py, where httpx.AsyncClient uses...
CVE-2026-54688
mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, weburlread passes a caller-supplied URL to the server-side fetch path while assertUrlAllowed in src/url-reader.ts runs only when MCPHTTPHARDEN is enable...
CVE-2026-54689
mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, the weburlread URL policy in src/url-reader.ts can be bypassed while MCPHTTPHARDEN is enabled and MCPHTTPALLOWPRIVATEURLS is not enabled because redirec...
CVE-2026-55226
Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and earlier, deploying only the Topic Operator or only the User Operator through the Kafka custom resource leaves the Entity Operator ServiceAccount with RBAC...
CVE-2026-55374
canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, Request::buildRequestUrl joins values returned by Request::getPathVariables without encoding individual path segments, including the scheme and contentId values used by GetContentDetailsRequest. When ...
CVE-2026-54050
Sakai is a Collaboration and Learning Environment CLE. From 23.0 until 23.5 and 25.3, the DELETE /api/users/userId/profile/image endpoint allows an authenticated user to delete another user's profile image because ProfileController.removeProfileImage passes the attacker-controlled userId to...
CVE-2026-54547
Meta Ads MCP is a Model Context Protocol MCP server that lets AI assistants run Meta Ads. Prior to version 1.0.115, AuthInjectionMiddleware in metaadsmcp/core/httpauthintegration.py rejects HTTP MCP requests only when both authtoken and pipeboardtoken are absent, while extracttokenfromheaders doe...
CVE-2026-53941
Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. From 0.27.0 until 0.53.1, the uprobe library resolver can allow an unprivileged container to consume excessive CPU and block other containers from starting...
CVE-2026-52484
An issue in MitraStar GPT-2742GX4X5v6-SV GLg2.5100XNT0b233 allows an authenticated attacker to execute arbitrary code via the /cgi-bin/device-management-utilities-internet.cgi component...
CVE-2026-53459
Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Starting in version 0.1.6 and prior to version 0.2.4.4, a fail-open in the authentication code allows any attacker to bypass authentication by flooding a public endpoint to exhaust resources causing database...
CVE-2026-53954
Bugsink is a self-hosted error tracking tool. Prior to version 2.2.2, Bugsink stores every set of custom tags supplied with an incoming event, allowing a caller with a valid project DSN to submit an unusually large tag set and force excessive tag-row writes. Because Bugsink uses a single-writer...
CVE-2026-54251
netty-incubator-codec-ohttp implements Oblivious HTTP OHTTP gateway and client functionality using Netty. Prior to 0.0.23.Final, the OHTTP gateway decryption path in codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpRequestResponseContext.java allocates a pooled direct ByteBuf for...
CVE-2026-48785
Apptainer is an open source container platform. Prior to version 1.5.1, Image.AuthorizedPath applies plain string-prefix matching to the limit container paths directive in apptainer.conf, so an allowed path such as /data/safe also authorizes a sibling path such as /data/safe-but-unsafe. A local...
CVE-2026-44300
OpenCost provides cost monitoring for Kubernetes workloads and cloud costs. Prior to 1.121.0, the POST /serviceKey endpoint in pkg/costmodel/router.go allows a network client to invoke AddServiceKey without mandatory authentication and submit an arbitrary key form value that is written to the GCP...
CVE-2026-45579
DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, the RequestManagementSystem/Service/ReqManagerHandler.py exportgetRequestCountersWeb function passes an authenticated caller-controlled groupingAttribute to...
CVE-2026-39039
In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is fully accessible to any JavaScript running on the page...
CVE-2026-39040
BharatMLStack up to and including 1.3.0 is vulnerable to Cross Site Scripting XSS via the component Trufflebox UI trufflebox-ui in ExpressionViewModal.jsx...
CVE-2026-39038
BharatMLStack up to and including v1.3.0 is vulnerable to Cross Site Scripting XSS in the component Trufflebox UI trufflebox-ui in GenericNumerixTable.jsx...
CVE-2026-40058
CrowdStrike released a security update to address a vulnerability in the Falcon sensor for Windows. The vulnerability only exists when the Microsoft Office File Malicious Macro Removal Windows policy setting is enabled and customers remain protected through the Cloud Anti-malware for Microsoft...
CVE-2026-18113
In Concrete CMS 9.0 to 9.5.2, the Top Navigation Bar block did not HTML-escape dropdown child page names before writing them into the page, so a user who could create or rename pages could store a script through a child page name and have it run in the browser of any visitor, editor, or...
CVE-2026-18115
Concrete CMS 9.2.0 to 9.5.2 did not enforce per-field edituserproperties permissions on the REST API user write endpoints PUT /ccm/api/1.0/users/uID and POST /ccm/api/1.0/users/uID/changepassword. A user with an update-scoped OAuth token and permission to edit only one non-sensitive field could...
CVE-2026-12910
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to bypass SAML SSO sign-in restrictions and authenticate without SSO due to missing...
CVE-2026-13210
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to access CI/CD variables outside their intended environment scope due to improper input...
CVE-2026-12751
IBM Cloud Pak for Business Automation is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...
CVE-2026-12752
IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resource...
CVE-2026-12728
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to execute arbitrary code due to a deserialization of untrusted...