Vulnerabilities
Recent vulnerabilities
Recent vulnerabilities from
π GNA-1 (CIRCL)
Select from 85 available sources using the dropdown above.
Bitnami VulnDB is not individually searchable yet β the search will cover the sources available on the search page.
| ID | Description | Published | Updated |
|---|---|---|---|
| bit-virtualenv-2026-102938 | virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection | 2026-10-06T11:57:39.681Z | 2026-10-06T12:12:21.709Z |
| bit-virtualenv-2026-102937 | virtualenv: Command injection via --prompt in activate.bat (batch activator) | 2026-10-06T11:57:38.510Z | 2026-10-06T12:12:21.709Z |
| bit-virtualenv-2026-102930 | virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use | 2026-10-06T11:57:37.353Z | 2026-10-06T12:12:21.709Z |
| bit-virtualenv-2026-102925 | virtualenv bash and fish activation scripts execute commands embedded in paths | 2026-10-06T11:57:36.174Z | 2026-10-06T12:12:21.709Z |
| bit-mlflow-2026-64849 | MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding) | 2026-08-21T05:51:48.507Z | 2026-10-06T12:12:21.709Z |
| bit-keycloak-2026-7507 | Org.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeover | 2026-08-25T11:42:36.076Z | 2026-10-06T12:12:21.709Z |
| bit-keycloak-2026-7307 | Keycloak: keycloak: denial of service via specially crafted saml input | 2026-08-25T11:42:33.470Z | 2026-10-06T12:12:21.709Z |
| bit-keycloak-2026-4634 | Keycloak: keycloak: denial of service via excessive processing of openid connect scope parameters | 2026-08-25T11:42:30.857Z | 2026-10-06T12:12:21.709Z |
| bit-keycloak-2026-2092 | Keycloak-services: keycloak: unauthorized access via improper validation of encrypted saml assertions | 2026-08-25T11:42:10.230Z | 2026-10-06T12:12:21.709Z |
| bit-jupyterlab-2026-102904 | JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs | 2026-10-06T11:44:18.332Z | 2026-10-06T12:12:21.709Z |
| bit-grafana-2026-81842 | Library panel can be moved into a folder without library panel create permission | 2026-10-06T11:44:57.778Z | 2026-10-06T12:12:21.709Z |
| bit-grafana-2026-81841 | Paused shared dashboard access tokens still expose data source configuration | 2026-10-06T11:44:56.354Z | 2026-10-06T12:12:21.709Z |
| bit-gitlab-2026-8937 | Missing Authorization in GitLab | 2026-10-06T12:10:24.619Z | 2026-10-06T12:12:21.709Z |
| bit-gitlab-2026-84739 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab | 2026-10-06T12:10:11.458Z | 2026-10-06T12:12:21.709Z |
| bit-gitlab-2026-4523 | Missing Authorization in GitLab | 2026-10-06T12:09:02.474Z | 2026-10-06T12:12:21.709Z |
| bit-gitlab-2026-10518 | Incorrect Authorization in GitLab | 2026-10-06T12:06:54.737Z | 2026-10-06T12:12:21.709Z |
| bit-envoy-2026-73553 | Envoy: RBAC Authorization Bypass via Path Parameters | 2026-09-29T08:43:19.227Z | 2026-10-06T12:12:21.709Z |
| bit-envoy-2026-73552 | Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header values | 2026-09-29T08:43:17.800Z | 2026-10-06T12:12:21.709Z |
| bit-envoy-2026-73551 | Envoy: Path normalization does not handle dot and dotdot segments with parameters | 2026-09-29T08:43:16.381Z | 2026-10-06T12:12:21.709Z |
| bit-envoy-2026-73550 | Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy | 2026-09-29T08:43:14.900Z | 2026-10-06T12:12:21.709Z |
| bit-envoy-2026-73549 | Envoy - Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL_DST clusters | 2026-09-29T08:43:13.487Z | 2026-10-06T12:12:21.709Z |
| bit-envoy-2026-73548 | Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend pool | 2026-09-29T08:43:12.086Z | 2026-10-06T12:12:21.709Z |
| bit-envoy-2026-73546 | Envoy: Stored XSS in Admin Stats Interface (/stats?format=html) | 2026-09-29T08:43:09.282Z | 2026-10-06T12:12:21.709Z |
| bit-envoy-2026-73513 | Envoy: oghttp2 upstream trailers incorrect handling | 2026-09-29T08:43:07.862Z | 2026-10-06T12:12:21.709Z |
| bit-envoy-2026-73512 | Envoy: use-after-free in QUIC on internal redirects | 2026-09-29T08:43:06.460Z | 2026-10-06T12:12:21.709Z |
| bit-envoy-2026-73511 | Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat) | 2026-09-29T08:43:05.031Z | 2026-10-06T12:12:21.709Z |
| bit-envoy-2026-50572 | Envoy: ext_authz - RawHttpClientImpl onSuccess 0x0 segfault | 2026-09-29T08:43:03.503Z | 2026-10-06T12:12:21.709Z |
| bit-envoy-2026-48521 | Envoy: HTTP/3 connection pool selection null-derefs in ProdClusterManagerFactory::allocateConnPool when transport_socket_options is null | 2026-09-29T08:42:58.854Z | 2026-10-06T12:12:21.709Z |
| bit-composer-2026-59944 | Composer: CVE-2026-59946 fix bypass via symlinked package bin path | 2026-09-25T12:20:02.481Z | 2026-10-06T12:12:21.709Z |
| bit-apache-2026-93546 | Apache HTTP Server: mod_dav_fs namespace overflow | 2026-10-06T11:41:09.369Z | 2026-10-06T12:12:21.709Z |