Tagged “cve.org”
CVEs tagged cve.org, newest first.
47435 CVEsRSS
CVE-2026-111817Medium· 5.3Apache Traffic Server: Dropping chunked trailers stalls a passthrough transfer until timeout
Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed (proxy.config.http.drop_chunked_trailers) until the connection times out, because it waits for the trailer bytes it has already dropped. …
CVE-2026-111811Critical· 9.0Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authentication
Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15,…
CVE-2026-112381Medium· 5.9Apache Traffic Server: Nullptr dereference in net_write_io on a POST half-close with chunked response
Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is being reparsed from a reentrant write-ready callback, a timing-dependent race intro…
CVE-2026-114438Medium· 4.2Keycloak-services: keycloak-services: required otp enrollment bypassed via update user locale required action ordering
A flaw was found in the Update User Locale required action of the Keycloak identity and access management solution. When this action is ordered before the Configure OTP action in a realm, the system may fail to enforce mandatory multi-fa…
CVE-2026-114374Medium· 4.3PoCleomoon-studios wiki-go fetch-metadata Endpoint metadata_api.go server-side request forgery
A vulnerability was identified in leomoon-studios wiki-go up to 1.9.1. This impacts an unknown function of the file internal/handlers/metadata_api.go of the component fetch-metadata Endpoint. Such manipulation leads to server-side reques…
CVE-2026-85518Medium· 6.1PoCOpenscap: openscap: arbitrary file write via path traversal in source datastream decomposition
A flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file, the application does not properly validate relative file path attributes, leading to a path traversal vulnerability. An attacker can exploit this flaw by tric…
CVE-2026-112408High· 8.1Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()
Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker …
CVE-2026-114375Medium· 6.3PoCleomoon-studios wiki-go Files Rename API files.go RenameFileHandler path traversal
A security flaw has been discovered in leomoon-studios wiki-go up to 1.9.1. Affected is the function RenameFileHandler of the file internal/handlers/files.go of the component Files Rename API. Performing a manipulation of the argument cu…
CVE-2026-114135High· 8.8Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization
Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced the normal KernelWebsocketHandler with WebSocketChannelsHandler, which authenticated the user but did not call author…
CVE-2026-114376Medium· 6.3PoCleomoon-studios wiki-go API editor.go SourceHandler path traversal
A weakness has been identified in leomoon-studios wiki-go up to 1.9.1. Affected by this vulnerability is the function SaveHandler/SourceHandler of the file internal/handlers/editor.go of the component API. Executing a manipulation can le…
CVE-2026-114136High· 7.5PoCDjango REST framework: JSONParser applies an attacker-named codec to the request stream
Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in rest_framework/parsers.py uses the client-supplied Content-Type charset value with codecs.getreader, which accepts byte-transform code…
CVE-2026-105931Low· 2.3Apache Pulsar: Missing authorization on transaction admin endpoints exposes transaction coordinator and transaction statistics of other tenants
The Apache Pulsar broker exposes a transaction administration REST API under /admin/v3/transactions. When authentication and authorization are enabled, most of the read endpoints of this API verify only that the request is authenticated …
CVE-2026-113870High· 8.8Improper Encoding of Server-Supplied JavaScript Values in MongoDB Compass BSON Parsing
MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployment containing a specially crafted view and opens that view for ed…
CVE-2026-105934High· 7.2Apache Pulsar: Missing tenant admin authorization check when truncating a partitioned topic
The Apache Pulsar broker admin REST API provides a truncate operation for persistent topics (DELETE /admin/v2/persistent/{tenant}/{namespace}/{topic}/truncate). Truncating a topic moves all subscription cursors of the topic to the end of…
CVE-2026-105933Low· 2.3Apache Pulsar: Namespace encryption requirement not enforced after a failure during topic initialization
Apache Pulsar allows an administrator to require end-to-end message encryption for all topics in a namespace by setting the encryption_required namespace policy. When this policy is set, the broker rejects messages that are published wit…
CVE-2026-105932Low· 2.3Apache Pulsar: Missing topic policy authorization on non-persistent topic entry filter endpoints
The Apache Pulsar broker admin REST API provides endpoints to read, set and remove the topic-level entry filter policy of a topic. For persistent topics these endpoints check that the caller is authorized for the entry filters topic poli…
CVE-2026-105935Medium· 4.9Apache Pulsar: Function trigger publishes to the input topic without checking the caller's produce permission
The Pulsar Functions Worker provides a REST API endpoint for triggering a function, which publishes a caller-supplied value to one of the function's configured input topics. The Functions Worker performs this publish with its own broker …
CVE-2026-113461Medium· 5.2mk-oracle: Local privilege escalation via insecure Oracle Home library loading
Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to the Oracle client library directory of an Oracle home listed in the 'oratab' file or to the 'oratab' file itself to execute code as root if an agent …
CVE-2026-105942High· 7.7Apache Pulsar: Original principal of proxied requests authorized with the proxy's authentication data, allowing privilege escalation
When a configured proxy role sends a request to the broker on behalf of another user (the original principal), the broker is designed to authorize both the proxy role and the original principal and to allow the request only if both are a…
CVE-2026-105936Medium· 5.3Apache Pulsar: Functions connectors list endpoint does not apply the super-user check of the worker connectors endpoint
The Pulsar Functions worker REST API provides two endpoints that return the catalog of Pulsar IO connectors installed on the functions worker: the worker connectors endpoint (/admin/v2/worker/connectors) and the deprecated functions conn…
CVE-2026-114266Medium· 6.3PoCProjectWorlds Advanced Library Management System profile.php mysqli_query sql injection
A security vulnerability has been detected in ProjectWorlds Advanced Library Management System 1.0. This impacts the function mysqli_query of the file profile.php. The manipulation of the argument admin_id leads to sql injection. The att…
CVE-2026-105938Low· 2.3Apache Pulsar: Subscription authorization policies not enforced by namespace-level backlog and unsubscribe operations and by topic expire-all
Apache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix subscription authentication mode, which requires a subscription name to start with the role name, or by granting permission on a subscriptio…
CVE-2026-105937High· 8.7Apache Pulsar: Missing authorization of the shadow topic source allows cross-tenant message disclosure and deletion of source topic data
Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic from that topic's managed ledger. The source topic is selected by setting the reserved topic property PULSAR.SHADOW_SOURCE. The admin REST A…
CVE-2026-111401Medium· 6.5WordPress Tailored Tools plugin <= 3.0.3 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Tailored Media Tailored Tools tailored-tools allows Cross Site Request Forgery.This issue affects Tailored Tools: from n/a through 3.0.3.
CVE-2026-105944Critical· 10.0Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin credential; end of life
Apache Pulsar Manager is a web console for administering Apache Pulsar clusters. It has its own user accounts and login, and it can be configured with an HTTP authentication credential, such as a token, that it uses to call the Pulsar ad…
CVE-2026-78117Medium· 4.2Race condition on shared HCI TX descriptor in the Infineon PSOC 6 BLESS Bluetooth driver can leak adjacent memory over the air
The Infineon PSOC 6 BLESS HCI driver in drivers/bluetooth/hci/hci_infineon_psoc6_bless.c stored the outgoing HCI packet descriptor in a file-scope variable, static cy_stc_ble_hci_tx_packet_info_t hci_tx_pkt. psoc6_bless_send() cleared an…
CVE-2026-78116Medium· 5.2Double free of an RTIO submission in the Broadcom AFBR-S50 sensor driver data-evaluation error path
The Broadcom AFBR-S50 time-of-flight sensor driver double-completes an RTIO submission when sensor data evaluation fails. In data_ready_work_handler() (drivers/sensor/broadcom/afbr_s50/afbr_s50.c), a non-STATUS_OK return from Argus_Evalu…
CVE-2026-19676High· 7.8PECI transfer syscall verifier does not validate embedded user buffer pointers, allowing arbitrary kernel memory read/write from user mode
The user-mode verifier for the peci_transfer() system call, z_vrfy_peci_transfer() in drivers/peci/peci_handlers.c, checked only the device object permission and copied the caller-supplied struct peci_msg with k_usermode_from_copy(). Tha…
CVE-2026-18748Low· 3.5Out-of-bounds read in Bluetooth Classic A2DP codec information element handling
The Bluetooth Classic A2DP host stores a codec Information Element (IE) in struct bt_a2dp_codec_ie, a one-byte len field plus a fixed 8-byte codec_ie[] array. When an AVDTP peer sent a codec IE longer than 8 bytes, a2dp_process_config_in…
CVE-2026-105945High· 7.7Apache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package Access in Filesystem Package Storage
The Pulsar Packages Management Service can be configured to store packages on the local filesystem of the broker by using the filesystem storage provider. Package names consist of a type, tenant, namespace, name and version. Authorizatio…