Connected evidence
Follow a shared identifier, source page or planning group across source records. Dates show chronology; a connection does not establish cause, a shared rollout or applicability to your environment.
Saved searches 0
Keep up to eight named searches. Saved in this browser. Filters are also shareable in the page address.
Threads
Related changes across sources- Jira Software Data Center: DoS (Denial of Service) browserslist Dependency (CVE-2026-73089) Advisory content revised: Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache …2 linked entries across history · in Security Follow evidence and connection reasons
- .NET Remote Code Execution Vulnerability Advisory content revised: Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.2 linked entries across history · in Security Follow evidence and connection reasons
- .NET Framework Elevation of Privilege Vulnerability Advisory content revised: Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network.2 linked entries across history · in Security Follow evidence and connection reasons
- .NET Remote Code Execution Vulnerability Advisory content revised: Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.2 linked entries across history · in Security Follow evidence and connection reasons
- .NET Information Disclosure Vulnerability Advisory content revised: Permissive list of allowed inputs in .NET allows an unauthorized attacker to disclose information over a network.2 linked entries across history · in Security Follow evidence and connection reasons
- .NET Information Disclosure Vulnerability Advisory content revised: Out-of-bounds read in .NET allows an unauthorized attacker to disclose information over a network.2 linked entries across history · in Security Follow evidence and connection reasons
- .NET Information Disclosure Vulnerability Advisory content revised: Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.2 linked entries across history · in Security Follow evidence and connection reasons
- .NET Remote Code Execution Vulnerability Advisory content revised: Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.2 linked entries across history · in Security Follow evidence and connection reasons
- SurrealDB before 1.5.4 Authentication Bypass via Database Switch Advisory content revised: SurrealDB before 1.5.4 and 2.0.0-alpha.1 before 2.0.0-alpha.6 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated session can impersonate an unre…3 linked entries across history · in Security Follow evidence and connection reasons
- Hono - Vary Header Injection in CORS Middleware Advisory content revised: Hono before 4.10.3 contains a flaw in its CORS middleware: when the origin is not set to "*", the middleware copies the Vary header from the incoming request into the response. Because Vary is a response header that should be managed by the…3 linked entries across history · in Security Follow evidence and connection reasons
- OpenClaw < 2026.3.24 - Symlink Traversal via IDENTITY.md appendFile in agents.create/update Advisory content revised: OpenClaw before 2026.3.24 contains a symlink traversal vulnerability in agents.create and agents.update handlers that use fs.appendFile on IDENTITY.md without symlink containment checks. Attackers with workspace access can plant symlinks to…3 linked entries across history · in Security Follow evidence and connection reasons
- CodeWhale before 0.8.64 Privilege Escalation via exec_shell_interact Advisory content revised: CodeWhale versions >= 0.3.10 and < 0.8.64 (published as deepseek-tui >= 0.3.10 and < 0.8.41 on npm and 0.3.10 through 0.8.41 on crates.io, and as codewhale / codewhale-tui >= 0.8.41 and < 0.8.64) contain a vulnerability in the exec_shell_in…3 linked entries across history · in Security Follow evidence and connection reasons
- CodeWhale before 0.8.64 Argument Injection via git_show Advisory content revised: CodeWhale versions >= 0.3.27 and < 0.8.64 (published as deepseek-tui >= 0.3.27 and < 0.8.41 on npm and 0.3.27 through 0.8.41 on crates.io, and as codewhale / codewhale-tui >= 0.8.41 and < 0.8.64) contain an argument injection vulnerability …3 linked entries across history · in Security Follow evidence and connection reasons
- @justice8096/sagemath-mcp-server: executes arbitrary code via the escapeShellString and sanitizeCode functions Advisory content revised: An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions.2 linked entries across history · in Security Follow evidence and connection reasons
- Backstage catalog rules can be bypassed for URL locations using encoded path segments Advisory content revised: Backstage is an open framework for building developer portals. Prior to 3.9.2 and from 4.0.0 until 4.0.2, DefaultCatalogRulesEnforcer in @backstage/plugin-catalog-backend compares the raw location.target URL against catalog.rules, while URL…2 linked entries across history · in Security Follow evidence and connection reasons
- systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks Advisory content revised: systeminformation is a System and OS information library for node.js. Prior to 5.33.16, services() in lib/processes.js inserts a caller-supplied service name into a PowerShell Get-CimInstance filter after processing it with sanitizeShellStr…2 linked entries across history · in Security Follow evidence and connection reasons
- Paperclip 2026.403.0 before 2026.416.0 RCE via Execution Workspace Cleanup Commands Advisory content revised: Paperclip: OS Command Injection via Execution Workspace cleanupCommand2 linked entries across history · in Security Follow evidence and connection reasons
- Ember: Unneutralised terminal escape/control sequences from Caddy logs injected into the operator's TUI Advisory content revised: Ember is a real-time terminal dashboard for Caddy servers with FrankenPHP support. Prior to 1.4.2, interactive TUI row formatters pass Caddy access-log fields, particularly the request URI, through the `fitCellLeft` render helper without ne…2 linked entries across history · in Security Follow evidence and connection reasons
- ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
- net: psp: do not inherit the Rx association on clone Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
- drm/amdgpu: keep the eviction fence until the last handle is closed Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
- spi: imx: fix slab corruption from undersized DMA bounce buffers Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
- namespace: a mount that copy_tree() leaves out can't take over a lock Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
- KVM: SEV: Fix page dirtying in sev_gmem_post_populate() Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
- firewire: core: fix race condition in split transaction handling Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
- Configuration Manager updates and servicing Guidance changed2 linked entries across history · in Windows Follow evidence and connection reasons
- i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf) Advisory content revised: i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-r…3 linked entries across history · in Security Follow evidence and connection reasons
- SiYuan v3.7.4-alpha.1 Information Disclosure via getAttributeViewFieldViews Advisory content revised: SiYuan: Database view structure (all view names, layout types and per-field visibility) is returned to anonymous readers by /api/av/getAttributeViewFieldViews3 linked entries across history · in Security Follow evidence and connection reasons
- SiYuan v3.7.4-alpha.2 Authorization Bypass via getAttributeViewSearchTarget Advisory content revised: SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route3 linked entries across history · in Security Follow evidence and connection reasons
- AD FS DKM container hardening Guidance changed3 linked entries across history · in Windows Follow evidence and connection reasons