| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-78268 | 7.5 | Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads <= 1.2.0 versions. | 2026-10-12 20:10:00 | 2026-08-24 22:17:20 |
| CVE-2026-89140 | - | Temporal Server does not bind internal completion callbacks to the namespace that attached them, which allows an authenticated caller with write permission in one namespace to alter Scheduler V2 schedule state in another namespace. The callback addre | 2026-10-12 19:16:40 | 2026-10-12 19:16:40 |
| CVE-2026-87744 | 9.1 | A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-decl | 2026-10-12 19:16:40 | 2026-10-12 19:16:40 |
| CVE-2026-85471 | 6.4 | A flaw was found in Quay. An authenticated repository administrator could bypass the hostname blacklist in webhook notifications, leading to a Server-Side Request Forgery (SSRF) vulnerability. This allows the Quay application to be tricked into sendi | 2026-10-12 19:16:40 | 2026-10-12 19:16:40 |
| CVE-2026-83536 | 5.3 | A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as ReadHeaderTimeout. This vulnerability allows an unauthenticated, remote attacker to initiate multiple slow | 2026-10-12 19:16:39 | 2026-10-12 19:16:39 |
| CVE-2026-83535 | 7.4 | A flaw was found in openstack-network-exporter. When an operator configures user authentication but omits or misconfigures Transport Layer Security (TLS), the basic authentication mechanism is silently bypassed. This fail-open design allows an adjace | 2026-10-12 19:16:39 | 2026-10-12 19:16:39 |
| CVE-2026-65954 | 8.6 | PHPCSUtils is a suite of utility functions for use with PHP_CodeSniffer. From 1.0.0-alpha1 until 1.2.3, PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey() evaluates attacker-controlled array-key expressions with eval(), allo | 2026-10-12 19:16:39 | 2026-10-12 19:16:39 |
| CVE-2026-59977 | 8.1 | ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the /delete/{id} endpoint uses HTTP GET for permanent deletion without CSRF protection. If an authenticated user visits attacker-controlled content that requests /delete/{id}, the br | 2026-10-12 19:16:39 | 2026-10-12 19:16:39 |
| CVE-2026-59976 | 8.1 | ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the ImageMagick converter uses the unsanitized convert_to parameter to construct an output path. If an authenticated user, or an unauthenticated user when ConvertX is configured to a | 2026-10-12 19:16:39 | 2026-10-12 19:16:39 |
| CVE-2026-57143 | 8.8 | PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxng_search and the search_web SearxNG provider pass the LLM-controlled searxng_url parameter directly to requests.get without validating its scheme, host, port, or resolved | 2026-10-12 19:16:39 | 2026-10-12 19:16:39 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/39518
Zapisa po stranici: