CVEs
Browse the synced catalog, newest first.
- CVE-2026-85708Chartbrew: Private chart data disclosure via forgeable CB_SECRET share tokenschartbrew
- CVE-2026-85295Chartbrew: Full account takeover via JWTs accepted under default CB_SECRETchartbrew
- CVE-2026-54349Chartbrew SQL injection in dashboard filter substitutionchartbrew
- CVE-2026-54589Chartbrew: SSRF guard bypass via IPv6 NAT64/DNS64 addresses in API Data Connection outbound policy (validateOutboundUrl)chartbrew
- CVE-2026-71397Unbounded request body accumulation on streaming RPCs causes memory exhaustion in grpc_serverelixir-grpc grpc_server · grpc_server
- CVE-2026-123787nexmoe VidBee Local HTTP Service local-api.ts information disclosurenexmoe VidBee
- CVE-2026-71863SecureDrop: Onion Service client auth credentials copied to Monitor Serverfreedomofpress securedrop
- CVE-2026-102610fast-agent: `fast-agent serve` binds HTTP to 0.0.0.0 with no authentication by default; with --shell this is unauthenticated remote…evalstate fast-agent · fast-agent-mcp
- CVE-2026-124078plist.js before 5.0.1 Uncontrolled Resource Consumption via Binary ParserTooTallNate plist.js
- CVE-2026-102657esm.sh: web.NewHandler allows arbitrary file read via encoded dot-segment path traversalesm-dev esm.sh · github.com/esm-dev/esm.sh/web
- CVE-2026-102344Lavish: DNS rebinding allows any website to read arbitrary local files and inject prompts into the AI agent via the unauthenticated local…kunchenguid lavish-axi
- CVE-2026-102530JupyterLab Desktop: Cross-Site Scripting (XSS) leading to Remote Code Execution on Connect URLjupyterlab-desktop
- CVE-2025-55002JupyterLab Desktop: TCC Bypass via Misconfigured Node Fusesjupyterlab-desktop
- CVE-2026-86044JupyterLab Desktop: One-Click Jupyter Server Token Leak leading to Remote Code Executionjupyterlab-desktop
- CVE-2025-54991JupyterLab Desktop: TCC Bypass via Insecure Entitlements (macOS)jupyterlab-desktop
- CVE-2026-85737Velociraptor: Low-priv analyst reads arbitrary server files via ungated sql() VQL pluginVelocidex velociraptor · www.velocidex.com/golang/velocirap…
- CVE-2026-634392FAuth: Reverse Proxy Guard Trusts Client-Supplied Headers Without Proxy VerificationBubka 2FAuth
- CVE-2026-634382FAuth: Reverse Proxy Guard Auto-Creates Users With Admin Promotion From Unauthenticated Header ValueBubka 2FAuth
- CVE-2026-634402FAuth: Authenticated SSRF via DNS rebinding in the otpauth image= icon fetch (validate-then-fetch TOCTOU)Bubka 2FAuth
- CVE-2026-634412FAuth: SSRF guard misses IPv6 NAT64 prefixes, allowing image fetch to reach internal/metadata targetsBubka 2FAuth
- CVE-2026-634372FAuth: Missing Authorization on Share Recipients Endpoint Allows Cross-User Account EnumerationBubka 2FAuth
- CVE-2026-59171JSON-java: JSONTokener Unbounded Numeric String Resource-Exhaustion DoSstleary JSON-java · org.json:json
- CVE-2026-65960Tetragon: Unauthenticated Tetragon gRPC admin API accessible from hostNetwork podscilium tetragon
- CVE-2026-58490Tracecat: Unsigned SAML response accepted in Docker Compose SAML deployments due to empty signing defaultsTracecatHQ tracecat
- CVE-2026-63663CloudBeaver: Path Traversal in updateResultsDataBatch Allows Unauthorized Server File Stream Accesscloudbeaver
- CVE-2026-63664CloudBeaver: Authorization Bypass (BFLA) - Data Export Restriction Bypasscloudbeaver
- CVE-2026-55449CloudBeaver: Path Traversal in Resource Manager getProjectPath allows directory enumeration outside shared-projects sandboxcloudbeaver
- CVE-2026-123974pytorch/serve: Local privilege escalation through insecure temporary pathPyTorch TorchServe
- GHSA-47W9-6R3F-938GLXD has restricted project bypass leading to arbitrary command executiongithub.com/canonical/lxd
- GHSA-7MR3-28H5-M5VXLXD has project restriction bypass for custom volume copy across projectsgithub.com/canonical/lxd