13,576 results · Clear filters · Feed
-
High 8.2
Telepresence: Tunnel endpoint accepts caller-supplied session ID with no ownership proof — active client sessions hijackable
Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager Tunnel gRPC streaming endpoint parses a session ID from the first bytes of a caller-controlled message in pkg/tunnel/message.go and p…
-
High 7.0
zizmor: Debug logging prints available GitHub credentials in cleartext
zizmor is a static analysis tool for CI/CD systems. In version 1.27.0, debug logging serializes the parsed application configuration with a derived Debug implementation for GitHubToken, causing credentials supplied through GH_TOKEN, GITHUB_TOKEN, ZIZMOR_GITHU…
-
High 7.5
Code Graph RAG: MCP paginated read_file path traversal / arbitrary file read
Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.345, the MCPToolsRegistry.read_file implementation in codebase_rag/mcp/tools.py joins attacker-controlled file…
-
High 7.7
Pocket ID: Client credentials grant allows any OIDC client to obtain tokens for arbitrary audiences
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 1.11.0 until 2.10.0, createTokenFromClientCredentials in backend/internal/service/oidc_service.go accepts the client-controlled resource parameter and embeds…
-
High 8.7
tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process
tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server calls JSON.parse outside a request-local error boundary in the POST /mcp handler in integrations/mcp-server/src/…
-
High 7.5
tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS
tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server accepts unauthenticated POST /mcp requests in integrations/mcp-server/src/index.ts and accumulates every request…
-
High 7.5
ag-psd: Uncontrolled Memory Allocation in PSD Layer Decoding (totalMemoryLimit bypass)
ag-psd is a JavaScript library for reading and writing Photoshop Document files. Prior to 31.0.3, readPsd() accepts a totalMemoryLimit for parsing untrusted PSD files, but decodeLayerImageData expects a differently named memoryLimit property and therefore pas…
-
High 7.3
traQ: Privilege escalation by OAuth prompt=none request
traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, OAuth2 silent authorization requests using prompt=none with an empty or omitted scope parameter check prior consent against the empty requested scope set even though all sc…
-
High 7.3
traQ: XSS in the User Uploaded File Retrieval API
traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQ_STORAGE_TYPE=local can return user-uploaded SVG or HTML content from the /files/{fileId} retrieval endpoint for direct browser rendering. An …
-
High 8.8
isomorphic-git: Arbitrary file write outside the working tree via a directory symlink during checkout (potential RCE)
isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's git.checkout writes new child paths through symlinked leading directory components without checking them. A malicious repository can first pl…
-
High 8.2
Logging Redactor: PII data in str/repr of non primitive objects was not being redacted
Logging Redactor is a Python library designed to redact sensitive data in logs based on regex patterns and / or dictionary keys. Prior to 0.0.7, personally identifiable information returned by custom object __str__ or __repr__ methods is not redacted when suc…
-
High 8.2
Unbounded request body accumulation on streaming RPCs causes memory exhaustion in grpc_server
Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc_server allows unauthenticated attackers to exhaust memory and crash the node via an oversized client-streaming or bidirectional-streaming request body. The streaming read c…
-
High 7.7
LXD has project restriction bypass for custom volume copy across projects
Reported from https://github.com/lxc/incus/security/advisories/GHSA-64f3-v33m-w89f ### Summary Missing authorization checks exist for custom volume copying where an attacker knowing the name of a project that they don't have access to and the name of a custom…
-
High 7.7
LXD has project restriction bypass in instance copy across projects
Reported from https://github.com/lxc/incus/security/advisories/GHSA-c9f5-j9c3-mhrg ### Summary Missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance i…
-
High 8.8CVE-2026-33050 Public exploit
GeoNode: OS command injection via uploaded file layer name
GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.1.0, a crafted vector file layer name supplied during upload allows a low-privileged remote user to inject shell syntax and execute…
-
High 8.6
OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy
OSAC operator is a Kubernetes operator. In the affected revision identified as 8220502, the `console-proxy` `RemoteConfigResolver` parses Kubernetes Secret kubeconfig data with `clientcmd.RESTConfigFromKubeConfig` without sanitizing the resulting `rest.Config…
-
High 8.2
Cowboy HTTP/1.1 Unbounded Buffering of Pipelined Data During Request Handling Enables Memory Exhaustion
Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process memory over HTTP/1.1. Once a request has been received in full and its handler is still running, cow…
-
High 8.7
Unbounded decoded HTTP/2 header-list size in cowlib cow_http2_machine enables HPACK amplification memory exhaustion
Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowlib allows an unauthenticated remote peer to exhaust the memory of an HTTP/2 endpoint via HPACK-indexed header fields. cow_http2_machine:headers_decode/4 in src/cow_http2_machi…
-
High 7.5
Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE
Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3, banks parses Tool JSON objects from the rendered body of {% completion %} blocks and later resolves their import_path field through importlib.import_module(..…
-
High 8.4
Broken Access Control in Canonical LXD DevLXD API
Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.v…
-
High 7.2
GroupEx PRO ( Daxko ) integration - Critical - Unsupported - SA-CONTRIB-2026-278
Vulnerability in Drupal GroupEx PRO ( Daxko ) integration. This issue affects GroupEx PRO ( Daxko ) integration versions: *.*.
-
High 8.9
Unbounded query cache growth from interpolated JSON paths and splice lists in Ecto
Allocation of Resources Without Limits or Throttling vulnerability in elixir-ecto ecto allows an unauthenticated remote attacker to exhaust memory in the application and in the database server by sending requests with distinct JSON keys or list lengths where …
-
High 7.8CVE-2026-115878 Public exploit
Stanza: RCE via pickle deserialization in the lemmatizer
Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. From 1.14.0 until 1.15.0, loading an attacker-supplied lemmatizer checkpoint can execute arbitrary code because stanza/models/lemma/trai…
-
High 7.4
Elo: Code injection in Elo backends via unvalidated emission of programmatic AST fields
Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, Elo's programmatic AST API accepts arbitrary values from JSON-deserialized input, plugin output, or other untyped sources and interpolates them into generated JavaScript, Ruby, …
-
High 8.1
Microsoft Security Advisory CVE-2026-111497 - .NET Brotli Decoder Out-of-bounds Write Vulnerability
## Executive summary A buffer overflow vulnerability exists in the Brotli decompression library used by .NET. This vulnerability may allow an unauthenticated attacker to read or corrupt process memory. This could lead to information disclosure, denial of serv…
-
High 8.2
praktor: Telegram upload traversal permits persistent agent instruction injection
praktor is a multi-agent Claude Code orchestrator with Telegram input and output, Docker isolation, and a Mission Control UI. Prior to 0.9.1, both Telegram upload sites in `internal/telegram/bot.go` concatenate the attacker-controlled document filename into a…
-
High 8.1CVE-2026-11800 Public exploit
Org.keycloak:keycloak-services: keycloak: authentication bypass via jwt algorithm confusion
A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypass signature verification. By forging an assertion, the attacker can create unauthorized acces…
-
High 7.3
Metalama's Visual Studio inter-process named pipe allows unsafe deserialization that enables local code execution
Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#. From 2023.0.101-rc until 2025.1.18, 2026.0.25 and 2026.1.19, the Windows Visual Studio integration deserializes local named-pipe messages without restricting which CLR types can …
-
High 7.6
AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's account
Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user's account, and then sign in as that user or hold their second factor. AshAuth…
-
High 7.9
Out-of-bounds read when decoding internal keys shorter than 16 bytes
`InternalKeyRef::from_encoded` is a safe constructor whose only length check is `debug_assert!(encoded.len() >= 16)`, which is compiled out in release builds. Its accessors perform unchecked length arithmetic on the slice: `user_key()` slices `&encoded[..len …
-
High 7.8
Data race and double free via unsound `Send`/`Sync` in `reblessive`
`dbs::Executor` drives every SurrealQL statement through `reblessive::tree::TreeStack`. In `reblessive 0.4.3` the runtime types unconditionally assert `Send`/`Sync` (`unsafe impl Send/Sync for Stack`, `TreeStack` and `Runner`), while the public entry points a…
-
High 7.1
SD JWT JS: Tampered disclosures silently dropped instead of rejected
SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT (SD-JWT) specification. In version 0.19.0 and earlier, `@sd-jwt/decode`, also used by `@sd-jwt/core`, silently drops a tampered Disclosure whose digest no longer matches the Issuer-signe…
-
High 8.2
`ant-releases`: extracting a release archive can write files outside the destination directory (path traversal / zip-slip)
`ant-releases` downloads and unpacks release archives from the `safe_network` / `autonomi` repositories. When it extracts an archive, it builds each output path by joining the archive entry's **own name** onto the destination directory, with no check for `..`…
-
High 7.5
Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server decompressed uploaded pipeline archives without adequately bounding expanded data while locating or reading the pipeline file. …
-
High 7.5
Kubeflow Pipelines: Run log streaming endpoint bypasses namespace authorization, exposing pod execution logs cross-tenant
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server's GET /apis/v1alpha1/runs/{run_id}/nodes/{node_id}/log handler retrieved logs without authorizing the caller against the select…
-
High 7.1
pypdf: Possible infinite loop when hitting EOF in standard xref table during trailer search
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop while opening a crafted incomplete PDF whose standard cross-reference table reaches the end of the file without a trailer. The trailer search can repeat…
-
High 7.1
pypdf: Possible large memory usage when parsing page tree
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can consume excessive memory while parsing a crafted PDF page tree containing many shared resources. Page-tree flattening copies page dictionary and inherited resource entries wit…
-
High 7.1
pypdf: Possible infinite loop when cloning dictionaries
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop when cloning or duplicating a crafted cyclic DictionaryObject. Clone traversal checked generated destination references rather than the original source …
-
High 7.5
joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service
joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and 18.3.1, the Joi.string().email({ multiple: true }) rule uses a separator regular expression whose leading whitespace quantifier is retried at every position …
-
High 7.5
@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service
@hapi/content provides HTTP Content-* header parsing. From 3.0.6 until 6.0.3, Content.disposition() uses an unanchored parameter-name expression in a global regular-expression scan, causing repeated failed matching over the remaining input when a Content-Disp…