CVE-2026-55xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
776 records · Page 8 of 8
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the `PUT /api/v2/users/{user}/password` endpoint authorized only `ActionUpdatePersonal` and did not prevent a `user-admin` from resetting an `owner` account's password. It also did not require the current password when an admin reset another user's password.
UpdatedCoder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, Coder's OIDC callback checked `email_verified` with a direct Go `bool` type assertion. When an IdP returned the claim as a non-boolean (for example the string `"false"`) or omitted it, the assertion failed open and the email was treated as verified. Combined
UpdatedCoder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, two flaws in Coder's OIDC login chained into account takeover. Email-based user matching fell back to linking by email without checking for an existing link to a different IdP subject and the `email_verified` claim was only enforced when present as a boolean
UpdatedAnsible FreeBSD Jail Connection Plugin is an Ansible connection plugin for FreeBSD Jails via jexec. Through version 1.3.0, the jailexec connection plugin's put_file resolved a transfer's destination to a path on the jail host ( + ) and ran mkdir -p and mv there as root on the host. Those commands follow symbolic links, and the path was operated on outside the jail, so a symlink existing inside the
Updated- CVE-2026-55073: WeasyPrint restrictive URL fetcher bypass allows local file read and SSRF 6.2 Medium
WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive url_fetcher and pass attacker-influenced values to HTML.write_pdf() can have the restriction bypassed through the xmp_metadata or stylesheets options. In weasyprint/pdf/init.py, xmp_metadata calls select_source() without the document url_fetcher, allowing an accessible loca
Updated Pimcore is an Open Source Data & Experience Management Platform. Prior to 2026.1.5, an authenticated user with the objects permission can submit a malicious ClassDefinition UID because the name and ID validation expressions in models/DataObject/ClassDefinition.php validate only the beginning of each value. When a data object of that class containing a Block field is loaded, Block::load in models/D
UpdatedMCP-for-Stata is a MCP server for integrating Stata into agent loops with a safety-first design. Prior to version 1.19.0, the ado_package_install MCP tool in stata-mcp concatenates user-controlled input directly into a Stata command string without any validation or sanitization. An attacker who can invoke the MCP tool or the equivalent Python API can embed newline characters in the package argumen
Updated- CVE-2026-55069: Kestra BasicAuth Password Stored as SHA-512 Enables Offline Brute-Force Attack 8.7 High
Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, this vulnerability exists in the BasicAuth authentication component of the Kestra OSS workflow orchestration platform. An attacker who gains read access to the PostgreSQL database can exploit SHA-512's high computation speed to recover the administrator password offline. In Kubernetes deployments, a successful crack fu
Updated free5GC is an open-source implementation of the 5G core network. In 4.2.2 and earlier, the NRF RegisterNFInstance handler at PUT /nnrf-nfm/v1/nf-instances/{nfInstanceID} accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or nfServices.ipEndPoints address constraints. The invalid profiles are persisted in the MongoDB NfProfile c
UpdatedVikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/{project}/views/{view}/buckets/{bucket} allows the request body project_view_id value to be mass assigned by Bucket.Update in pkg/models/kanban.go. The permission check validates that the bucket currently belongs to the URL project and view but does not validate the body selected destination view,
UpdatedVikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}/tasks accepts a body supplied task_id but TaskBucket.CanUpdate in pkg/models/kanban_task_bucket.go authorizes only the project, view, and bucket from the URL. updateTaskBucket then calls Task.ReadOne without a separate task permission check, returns the vict
UpdatedVikunja is an open-source self-hosted task management platform. From 0.24.6 until 2.4.0, DELETE /api/v1/projects/:project/views/:view permits an authenticated user to supply a view identifier from another project while authorizing only against an attacker-controlled project identifier. ProjectView.CanDelete in pkg/models/project_view_permissions.go does not establish that the view belongs to the p
UpdatedVikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shared child project can detach it from its parent hierarchy by submitting parent_project_id equal to 0 to POST /api/v1/projects/{project}. The Project.CanUpdate authorization check in pkg/models/project_permissions.go and UpdateProject logic in pkg/models/project
Updateduniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with the selected hooks directory, allowing parent-directory components to escape that directory. The resulting path is passed to the configured editor, which can access or modify files outside the hooks directory with the privi
Updateduniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go parses UNIGET_EDITOR or EDITOR with strings.Split(editor, " ") and passes every space-delimited suffix as an argument to the selected editor executable. An attacker who can influence the editor environment and cause hook editing can supply unexpected editor arguments, p
UpdatedGoCD is a continuous deliver server. From 13.1.0 until 26.1.0, the /go/api/support/process_list endpoint does not enforce its intended administrator-only authorization. An authenticated internal user can query the endpoint while source control child processes are running and view command-line arguments, usernames, remote material URLs, and internal material paths for materials the user cannot othe
UpdatedOpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions prior to 3.2.10, 3.3.12 and 3.4.13 contain a heap out-of-bounds write in Imf_4_0::SampleCountChannel::set(int r, unsigned int newNumSamples[]). The row-based sample-count setter computes the target Y coordinate with dataWindow.min.x instead of dataWindow.min.y. F
UpdatedOut-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
UpdatedInteger overflow or wraparound in Microsoft Office allows an unauthorized attacker to disclose information locally.
UpdatedHeap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
UpdatedStack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
UpdatedOut-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
UpdatedHeap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
UpdatedMissing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
UpdatedServer-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
UpdatedOut-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
UpdatedHeap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
UpdatedInteger overflow or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
UpdatedOut-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
UpdatedOut-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
UpdatedOut-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.
UpdatedOut-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
UpdatedHeap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.
UpdatedUse of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information locally.
UpdatedHeap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
UpdatedWeak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.
UpdatedInteger underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
UpdatedStack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
UpdatedHeap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
UpdatedBuffer over-read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
UpdatedOut-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
UpdatedImproper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
UpdatedInteger overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to execute code locally.
UpdatedUse after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
UpdatedOut-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
UpdatedImproper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
UpdatedHeap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
UpdatedOut-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
UpdatedOut-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
UpdatedInteger overflow or wraparound in Microsoft Office allows an unauthorized attacker to disclose information locally.
UpdatedAccess of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
UpdatedAccess of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
UpdatedOut-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
UpdatedAccess of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
UpdatedImproper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
UpdatedImproper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
UpdatedImproper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
UpdatedUse after free in Microsoft Office allows an unauthorized attacker to execute code locally.
UpdatedHeap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
UpdatedImproper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
UpdatedUncontrolled search path element in Windows Remote Help allows an authorized attacker to deny service locally.
UpdatedImproper access control in Windows Remote Help Defense allows an authorized attacker to elevate privileges locally.
UpdatedUncontrolled search path element in Windows Remote Help Defense allows an authorized attacker to perform spoofing locally.
UpdatedInteger overflow or wraparound in Microsoft Defender allows an unauthorized attacker to execute code locally.
UpdatedInteger underflow (wrap or wraparound) in Microsoft Defender allows an unauthorized attacker to execute code locally.
UpdatedHeap-based buffer overflow in Minecraft Bedrock Dedicated Server allows an unauthorized attacker to execute code over a network.
UpdatedDeserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
UpdatedImproper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
UpdatedDouble free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.
UpdatedInsufficient granularity of access control in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
UpdatedDouble free in Microsoft Printer Drivers allows an authorized attacker to elevate privileges locally.
Updated- CVE-2026-55003: Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability 6.5 Medium
Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network.
Updated External control of file name or path in SQL Server allows an authorized attacker to elevate privileges over a network.
UpdatedImproper certificate validation in Windows Active Directory allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows USB Print Driver allows an unauthorized attacker to elevate privileges with a physical attack.
Updated