CVEs
Browse the synced catalog, newest first.
- GO-2026-6841Echo: X-Real-IP extractor trusts the header value instead of the sending peer in github.com/labstack/echogithub.com/labstack/echo/v5
- GO-2026-6842Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echogithub.com/labstack/echo/v4
- CVE-2026-113663AG2: Newline injection in SandboxShellTool bypasses allowed=[...] and readonly=True, enabling arbitrary command executionag2ai ag2 · ag2ai autogen +2
- CVE-2026-102943Dagu MCP DAG specification read bypasses path containment and workspace isolationdagucloud dagu · github.com/dagu-org/dagu/v2
- CVE-2026-68509FairEmail: Path traversal in shared attachment handling can write files outside the intended shared directoryM66B FairEmail
- CVE-2026-92698FastNetMon: sFlow header_size field trusted as parser capture length causes remote out-of-bounds readpavel-odintsov fastnetmon
- CVE-2026-92697FastNetMon: NetFlow v9 unbounded strlen() on interface-description field causes remote out-of-bounds readpavel-odintsov fastnetmon
- CVE-2026-110390FlexNet Beacon Missing Authentication VulnerabilityFlexera FlexNet Beacon · Flexera FlexNet Manager Suite
- CVE-2026-92693FastNetMon: IPv6 Fragment header dereferenced without bounds check in shared packet parserpavel-odintsov fastnetmon
- CVE-2026-93424FastNetMon: NetFlow/IPFIX template cache returns unlocked pointers, causing heap-use-after-free on multi-port deploymentspavel-odintsov fastnetmon
- CVE-2026-92695FastNetMon: Legacy pcap parse_packet() has no bounds checking, causing out-of-bounds read on truncated framespavel-odintsov fastnetmon
- CVE-2026-92694FastNetMon: IPv6 host counters map iterated without lock, racing concurrent insertspavel-odintsov fastnetmon
- CVE-2026-88982Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook…kubeflow pipelines · github.com/kubeflow/pipelines
- CVE-2026-77596Kubeflow Pipelines API server lacks authorization for shared pipeline uploadskubeflow pipelines · github.com/kubeflow/pipelines
- CVE-2026-88981Kubeflow Pipelines: Unauthenticated SSRF through artifact provider endpointskubeflow pipelines
- CVE-2026-88980Kubeflow Pipelines: Unauthenticated server-side request forgery in the frontend http/https artifact source via decimal-IP bypass of the…kubeflow pipelines
- CVE-2026-88979Kubeflow Pipelines: Unauthenticated SSRF vulnerability in Kubeflow Pipelines TensorBoard proxykubeflow pipelines
- CVE-2026-88984Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelineskubeflow pipelines · github.com/kubeflow/pipelines
- CVE-2026-88986Kubeflow Pipelines: Reflected XSS in the frontend pod information and events error responseskubeflow pipelines · github.com/kubeflow/pipelines
- CVE-2026-88985Kubeflow Pipelines: SQL injection through unvalidated pagination tokens in Kubeflow Pipelines API serverkubeflow pipelines · github.com/kubeflow/pipelines
- CVE-2026-122267MinIO Signature V4 verification before RELEASE.2026-09-22T19-25-18Z accepts unsigned x-amz- headers, letting a presigned PUT URL be…Chainguard MinIO
- CVE-2026-111495API keys, credentials, and configuration parameters embedded in the MatchPoint APKTPC Software Matchpoint
- CVE-2026-88983Kubeflow Pipelines — API server fetches a caller-supplied pipelineURL without host validationkubeflow pipelines · github.com/kubeflow/pipelines
- CVE-2026-111494Incorrect validation of TLS certificates in the MatchPoint Android appTPC Software Matchpoint
- CVE-2026-58273Rucio: Authorisation Bypass on REST API endpoint for signing URLsrucio
- CVE-2026-111493Lack of authentication and authorization in the Images.ashx endpoint in MatchPointTPC Software Matchpoint
- CVE-2026-112908filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a…tox-dev filelock · filelock
- CVE-2026-111492SQL injection in the push notification handler of the MatchPoint Android appTPC Software Matchpoint
- CVE-2026-111491Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferencesTPC Software Matchpoint
- CVE-2026-112938filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local…tox-dev filelock · filelock