Export limit exceeded: 376996 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (376996 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-21764 | 1 Hcltech | 1 Devops Loop | 2026-08-13 | 3.1 Low |
| HCL DevOps Loop is affected by insufficient input validation that allows special characters where they should be restricted. This may result in unintended application behavior under certain conditions. | ||||
| CVE-2026-72526 | 1 Redhat | 2 Acm, Advanced Cluster Management For Kubernetes | 2026-08-13 | 9.9 Critical |
| A flaw was found in the multicloud-integrations component. The Application propagation controller processes the `ocm-managed-cluster` annotation from an Application Custom Resource (CR) without proper validation. A tenant with permissions to create Applications on the hub cluster can exploit this to target arbitrary managed clusters. This can force ArgoCD on the spoke clusters to synchronize attacker-controlled manifests, leading to arbitrary code execution or privilege escalation on those clusters. | ||||
| CVE-2026-70398 | 1 Redhat | 2 Acm, Advanced Cluster Management For Kubernetes | 2026-08-13 | 9.6 Critical |
| A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows an authenticated user, referred to as a tenant, to manipulate the GitOpsCluster controller. By exploiting this, a tenant can redirect sensitive spoke cluster bearer tokens from secure locations to a namespace they control. This unauthorized access to tokens can lead to the disclosure of critical information and bypass security policies within ArgoCD AppProjects. | ||||
| CVE-2026-73122 | 1 Redhat | 2 Acm, Advanced Cluster Management For Kubernetes | 2026-08-13 | 7.7 High |
| A flaw was found in the multicloud-operators-channel component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a compromised agent from a managed cluster to gain unauthorized access to sensitive information. Specifically, the agent can read all Secrets and ConfigMaps within any Channel namespace on the hub, potentially exposing credentials for other tenants' Git and Helm repositories. This could lead to significant information disclosure. | ||||
| CVE-2026-64927 | 1 Redhat | 2 Acm, Advanced Cluster Management For Kubernetes | 2026-08-13 | 6.4 Medium |
| A flaw was found in the multicloud-operators-channel component. This vulnerability allows a user with specific permissions to manipulate how the system handles sensitive information, known as Secrets, across different parts of the system (namespaces). By exploiting this, an attacker can modify these Secrets in unauthorized areas. This could lead to unauthorized access to information or elevated privileges within the system. | ||||
| CVE-2026-3639 | 2 Buildwps, Wordpress | 2 Ppwp – Password Protect Pages, Wordpress | 2026-08-13 | 6.4 Medium |
| The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `ppwp` shortcode attributes in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-73607 | 1 Siyuan | 1 Siyuan | 2026-08-13 | 5.8 Medium |
| SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attackers can retrieve outline state including heading identifiers for any document by supplying its identifier, even for documents forbidden to the requester. | ||||
| CVE-2026-73609 | 1 Siyuan | 1 Siyuan | 2026-08-13 | 5.8 Medium |
| SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getBookmarkLabels endpoint that returns all bookmark labels in the workspace without publish-access filtering. Anonymous readers and publish-mode readers can obtain the complete bookmark vocabulary across the workspace, disclosing subject matter and organizational information from inaccessible documents. | ||||
| CVE-2026-73610 | 1 Siyuan | 1 Siyuan | 2026-08-13 | 5.8 Medium |
| SiYuan before v3.7.4 contains an information disclosure vulnerability in the local storage filter that returns the administrator's entire storage map with only three keys sanitized. Unauthenticated attackers or publish readers can retrieve closed-tab history, search keywords, private document identifiers, and expanded folder paths by calling the getLocalStorage endpoint. | ||||
| CVE-2026-18725 | 1 Open-iscsi Project | 1 Open-iscsi | 2026-08-13 | 6.3 Medium |
| AI_ONLY_REPORT package: iscsi-initiator-utils-6.2.1.11-0.git4b3e853.el10 ------ Summary: Out-of-Bounds Write and Information Disclosure via Unvalidated IPv6 Payload Length: crafted ICMPv6 Echo Requests can cause `iscsiuio` to trust an inflated `ipv6_plen` larger than the actual received payload, leading to MTU-bounded out-of-bounds reads and a potential one-byte out-of-bounds write that may disclose data beyond the valid packet boundary. Requirements to exploit: Adjacent-network access on the same L2 segment as a system running `iscsiuio` on an interface that processes IPv6/NDP traffic, plus the ability to send a crafted ICMPv6 Echo Request with a forged `IPv6.plen`. No authentication or user interaction is required. Component affected: `iscsi-initiator-utils` (`iscsiuio`): `iscsiuio/src/uip/ipv6.c` in `ipv6_icmp_handle_echo_request()` and `ipv6_insert_protocol_chksum()`. Version affected: `iscsi-initiator-utils-6.2.1.11-0.git4b3e853.el10` when `iscsiuio` is processing IPv6/NDP traffic on a reachable interface. Patch available: no released package fix established; proposed patch included below Version fixed: unknown Upstream coordination: Not notified. CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - 6.3 (MEDIUM) AV:A - Reachability is limited to an attacker on the same L2 segment who can send crafted IPv6/ICMPv6 traffic to the affected interface. AC:L - The attack relies on forging `IPv6.plen`; no race or unusual environment is needed beyond the vulnerable deployment. PR:N - No privileges are required. UI:N - No user interaction is required. S:U - The impact remains within the `iscsiuio` process and its packet buffer handling. C:L - The reply/checksum path can read and potentially transmit data beyond the valid packet boundary, but the demonstrated exposure is MTU-bounded. I:L - For odd forged lengths, the checksum path can write a single padding byte past the valid protocol data, which may affect adjacent buffer contents. A:L - Invalid memory access may destabilize or crash the process, but reliable high-impact denial of service is not established from the available evidence. Impact: Moderate. Under Red Hat's severity guidance, this is more consistent with a flaw that can affect confidentiality, integrity, or availability under constrained circumstances than with an Important issue. The bug is unauthenticated and adjacent-network reachable, but the currently supported outcome is MTU-bounded out-of-bounds access in a deployment-dependent IPv6/NDP path, not easy remote system compromise or clearly high-impact memory corruption. Embargo: no Reason: The currently supported impact is Moderate, exposure depends on `iscsiuio` processing IPv6 traffic on a reachable L2 segment, and operators can reduce exposure operationally by isolating or disabling the affected path. Acknowledgement: Aisle Research Vulnerability Details: In the ICMPv6 echo-reply path, the code reuses the inbound `ipv6_plen` field when sizing the reply instead of clamping it to the bytes actually received: ```c /* iscsiuio/src/uip/ipv6.c */ static void ipv6_icmp_handle_echo_request(struct ipv6_context *context) { ... ipv6_send(context, (u8_t *) icmp - (u8_t *) eth + sizeof(struct ipv6_hdr) + HOST_TO_NET16(ipv6->ipv6_plen)); } ``` Later, checksum generation also trusts `ipv6_plen` for memory traversal, and for odd lengths it writes a padding byte at `ptr + protocol_data_len` before iterating over `protocol_data_len` bytes: ```c /* iscsiuio/src/uip/ipv6.c */ protocol_data_len = HOST_TO_NET16(ipv6->ipv6_plen); ... if (protocol_data_len & 1) { *((u8_t *) ptr + protocol_data_len) = 0; protocol_data_len++; } for (i = 0; i < protocol_data_len / 2; i++) { sum += HOST_TO_NET16(*ptr); ptr++; } ``` The available receive-side logic does not establish a payload-length bound strong enough to eliminate this condition. `uip_input()` compares the IPv6 payload length against `uip_len`, but `uip_len` is treated as full frame length in the observed path rather than the actual IPv6 payload length, and `ipv6_rx_packet()` receives a `len` argument without using it to bound parsing. A forged `ipv6_plen` can therefore exceed the real IPv6 payload stored in the buffer. The available evidence supports MTU-bounded out-of-bounds access in normal receive paths rather than the earlier arbitrary 64KB worst case. The affected logic appears to be present in the available 6.2.1.11 code base, but this report is scoped to the scanned SRPM package. Steps to reproduce: 1. Build `iscsiuio` with ASAN enabled. 2. Run `iscsiuio` with IPv6/NDP active on a test interface. 3. From the same L2 segment, send an ICMPv6 Echo Request with `IPv6.plen` set larger than the actual payload bytes in the frame buffer; one tested shape is `plen=1491` with an Ethernet frame size near 1500 bytes. 4. Observe the reply path: ASAN reports invalid access in `ipv6_insert_protocol_chksum()` as the checksum walk reads past valid packet data, odd lengths may also trigger a one-byte write, and reply sizing is derived from the forged `ipv6_plen` rather than the actual received payload size. Mitigation: Until a fix is available, keep `iscsiuio`-managed interfaces on trusted L2 segments only. Where operationally acceptable, disable IPv6 on those interfaces or filter ICMPv6 Echo Requests before they reach `iscsiuio`. If `iscsiuio` is not processing IPv6/NDP traffic, this specific path is not reachable. Proposed Fix: Clamp the reply payload length to the actual received payload derived from `context->ustack->uip_len`, reject packets too short to contain a complete ICMPv6 header, and rewrite `ipv6->ipv6_plen` before calling `ipv6_send()`. ```diff diff --git a/iscsiuio/src/uip/ipv6.c b/iscsiuio/src/uip/ipv6.c @@ -1100,6 +1100,8 @@ static void ipv6_icmp_handle_echo_request(struct ipv6_context *context) { struct eth_hdr *eth = (struct eth_hdr *)context->ustack->data_link_layer; +u16_t rx_total, rx_payload, hdr_plen, safe_plen; +u16_t l2_l3_len = sizeof(struct eth_hdr) + sizeof(struct ipv6_hdr); struct ipv6_hdr *ipv6 = (struct ipv6_hdr *)context->ustack->network_layer; struct icmpv6_hdr *icmp = (struct icmpv6_hdr *)((u8_t *)ipv6 + @@ -1126,8 +1128,20 @@ static void ipv6_icmp_handle_echo_request(struct ipv6_context *context) icmp->icmpv6_code = 0; icmp->icmpv6_cksum = 0; ILOG_DEBUG("IPv6: Send echo reply"); -ipv6_send(context, (u8_t *) icmp - (u8_t *) eth + sizeof(struct ipv6_hdr) + HOST_TO_NET16(ipv6>ipv6_plen)); + +rx_total = context->ustack->uip_len; +if (rx_total <= l2_l3_len) +return; + +rx_payload = rx_total - l2_l3_len; +hdr_plen = HOST_TO_NET16(ipv6->ipv6_plen); +safe_plen = (hdr_plen <= rx_payload) ? hdr_plen : rx_payload; +if (safe_plen < sizeof(struct icmpv6_hdr)) +return; + +ipv6->ipv6_plen = HOST_TO_NET16(safe_plen); +ipv6_send(context, l2_l3_len + safe_plen); + return; } ``` ------ This report was generated using AI technology. Always review AI-generated content prior to use | ||||
| CVE-2026-7366 | 1 Ibm | 3 Datapower Gateway 1050, Datapower Gateway 1060, Datapower Gateway 1100 | 2026-08-13 | 4.2 Medium |
| IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0.21 and IBM DataPower Gateway 10.6.0.0 through 10.6.0.9 allows a race condition that results in improper isolation of request state when handling the built‑in X‑Client‑IP header. Under concurrent request processing, X‑Client‑IP values may be contaminated across requests, enabling IP spoofing and disclosure of other clients’ IP addresses. | ||||
| CVE-2026-73626 | 1 Jupyter | 1 Jupyterlab | 2026-08-13 | 0 Low |
| JupyterLab versions >=4.6.0,<=4.6.1 and <=4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install(). A missing 'await' caused the is_install_allowed coroutine to never execute, so the extension allowlist/blocklist check was not enforced for direct callers of install(). The stock JupyterLab HTTP API and Extension Manager UI are not affected, as they perform a separate, correctly awaited check. The issue affects only deployments where a custom extension or downstream integration imports PyPIExtensionManager and calls install() directly with a package name influenced by untrusted input, an allowlist/blocklist is configured, the PyPI Extension Manager is enabled, and kernels and terminals are disabled or delegated to remote hosts. Fixed in JupyterLab 4.6.2 and 4.5.10. | ||||
| CVE-2026-73622 | 1 Gitpython-developers | 1 Gitpython | 2026-08-13 | 7.5 High |
| GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into .git/config and .gitmodules, then transmitted to attacker-controlled hosts during fetch or pull operations. | ||||
| CVE-2026-73618 | 1 Budibase | 1 Budibase | 2026-08-13 | 8.3 High |
| Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON metacharacters. Attackers with query write permission can inject JSON structural characters to alter MongoDB queries, bypassing filters to read, modify, or delete arbitrary documents. | ||||
| CVE-2026-73614 | 1 Jovancoding | 1 Network-ai | 2026-08-13 | 8.8 High |
| Network-AI ClaudeHookBridge before 5.15.1 truncates the target string to 500 characters before evaluating denyPatterns, while Claude Code executes the full untruncated command. Attackers can position dangerous content past byte 500 in a Bash command field to bypass the operator's hard-deny list and execute arbitrary commands. | ||||
| CVE-2026-73606 | 2026-08-13 | 5.8 Medium | ||
| SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/block/getRefIDs endpoint that fails to check password-protected document tiers. Unauthenticated readers can discover that password-protected documents reference specific blocks and obtain block identifiers without entering the document password. | ||||
| CVE-2026-73602 | 1 Flowiseai | 1 Flowise | 2026-08-13 | N/A |
| Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment locale validation bypass. Attackers can craft a fake String object with a match function that bypasses path traversal checks to load and execute malicious JavaScript files stored in the document store outside the sandbox. | ||||
| CVE-2026-73501 | 1 Getkin | 1 Kin-openapi | 2026-08-13 | 9.1 Critical |
| kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI security requirement to be satisfied for unauthenticated requests when an application relies on ValidationHandler as its enforcement middleware. The no-op callback prevents the fail-closed ErrAuthenticationServiceMissing path from being reached and forwards the request to protected handlers that may require an API key, OAuth token, or another security scheme. This issue is fixed in version 0.144.0. | ||||
| CVE-2026-73495 | 1 Http4s | 1 Blaze | 2026-08-13 | 7.4 High |
| blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and 1.0.0-M42, blaze-server can merge HTTP/1.1 chunked-body trailer fields into Request.headers. Because trailer fields are attacker-controlled, an unauthenticated remote client can inject arbitrary header names and values, including X-Forwarded-For and internal authorization headers, that a fronting proxy sanitized from the request-header section, bypassing header-based trust decisions in the application. Any http4s application using BlazeServerBuilder over HTTP/1.1 whose routes or middleware trust proxy-set headers, including X-Forwarded-For, X-Real-IP, and X-Forwarded-Host, is affected. If a fronting proxy strips or normalizes those headers but forwards chunked bodies with trailers intact, an attacker can spoof client IP for allow-lists, rate limits, or auditing, forge the https scheme, or inject internal authorization headers. A promoted Connection: close trailer is also honored, allowing attacker-controlled termination of pooled backend connections. This issue is fixed in versions 0.23.18 and 1.0.0-M42. | ||||
| CVE-2026-73486 | 1 Flowiseai | 1 Flowise | 2026-08-13 | N/A |
| Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's customReadCSV parameter that allows authenticated attackers to execute arbitrary Python code. The validator uses a static regex blocklist that can be bypassed through obfuscation techniques, enabling attackers to execute code in the unsandboxed pyodide environment with full system access. | ||||