377573 matches found
CVE-2026-49992
Technical details for CVE-2026-49992 are not publicly available in the provided documents. Monitor for updates from official advisories; no affected products, root cause, impact, or remediation are specified here.
CVE-2026-15618
CVE-2026-15618 affects mosaxiv clawlet up to 0.2.10. The flaw is in the function guardExecCommand in the file tools/tool_exec.go of the exec Safety Guard component. The manipulation causes a protection mechanism failure and can be exploited remotely; the exploit has been released publicly. The re...
CVE-2026-47677
Consolidated details from the connected advisory show a real vulnerability in FacturaScripts: an unauthenticated 2FA validation endpoint (Core/Controller/Login.php twoFactorValidationAction) accepts only fsNick and fsTwoFactorCode, with no password, no CSRF check, and no rate limiting. The TwoFac...
CVE-2026-15607
TanStack DB up to 0.6.8 contains a vulnerability in the Alias Path Handler’s select function (src/query/compiler/select.ts) that allows improperly controlled modification of object prototype attributes (prototype pollution). Impacted component: TanStack DB; vulnerability arises from the select fu...
CVE-2026-15605
The vulnerability CVE-2026-15605 affects wandb 0.25.2.dev1, specifically the ArtifactManifestEntry.download path in wandb/sdk/lib/hashutil.py under Artifact Integrity Validation. The issue is described as the use of a weak hash due to manipulating the ArtifactManifestEntry.download, with the atta...
CVE-2026-57856
Cockpit CMS exposes a path traversal in the Bucket file storage API (/system/buckets/api). The api() function sanitizes the bucket name with a regex that still allows ".." and "../" sequences, which are then interpolated into uploads://buckets/{bucket} and not blocked by Flysystem’s WhitespacePat...
CVE-2026-58489
HedgeDoc prior to v1.11.0 is vulnerable to a CSRF-like flaw in the GitHub Gist export callback. The OAuth2 state value was only checked for presence, not validated against the user session, allowing an attacker to craft a callback URL with their own valid GitHub OAuth code. When a logged-in victi...
CVE-2026-57855
Cockpit CMS is affected by a missing authorization vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php executes bucket commands (ls, upload, removefiles, rename, createfolder) without ACL or role checks, allowing any authen...
CVE-2026-58102
Summary of CVE-2026-58102 : Crypt::OpenSSL::X509 (Perl) versions before 2.1.3 are affected by a heap out-of-bounds read when processing long certificate extension OIDs in hv_exts. The vulnerability arises while building the extension hash through extensions(), extensions_by_long_name(), extension...
CVE-2026-58101
CVE-2026-58101 affects Crypt::OpenSSL::X509 before 2.1.3 for Perl. The issue arises when X509V3_EXT_d2i(ext) returns NULL if an extension fails to parse, yet basicC, ia5string, and auth_att dereference the result without a NULL check, and keyid_data dereferences akid->keyid even when the AKI s...
CVE-2026-58486
CVE-2026-58486: HedgeDoc prior to 1.11.0 is vulnerable to a YAML alias bomb in note frontmatter. HedgeDoc parses frontmatter with js-yaml.load (js-yaml v3) via @hedgedoc/meta-marked, resolving YAML anchors and potentially expanding a malicious payload into a huge object, consuming CPU on each req...
CVE-2026-39259
Technical details for CVE-2026-39259 are not publicly available in the provided documents. No affected products, vectors, or remediation are described. Monitor for updates.
CVE-2026-38165
Technical details for CVE-2026-38165 are not publicly available in the provided documents. Monitor for updates.
CVE-2026-54337
Technical details for CVE-2026-54337 are not publicly available in the provided documents. Monitor for updates and new disclosures.
CVE-2323-41892
Technical details for CVE-2323-41892 are not publicly available in the provided documents. Monitor for updates as new information may be released.
CVE-2026-36851
Technical details about CVE-2026-36851 are not publicly available in the provided documents. Monitor for updates.
CVE-2026-15598
The CVE affects antv layout 2.0.0, specifically the setNestedValue function in lib/util/object.js. A manipulation of the argument path can lead to prototype pollution, allowing remote modification of object prototype attributes. The advisory notes the attack can be launched remotely, with low att...
CVE-2026-25194
Technical details for CVE-2026-25194 are not publicly available in the provided documents. No affected products, vulnerable components, or remediation information are specified. Monitor for updates as the entry is reserved/placeholder.