ENISA
organizationEU01
roles
Roles this identity holds.
02
references
Other names and identifiers for this entity.
enisa_euvdEU vulnerability@enisa.europa.eu
03
assessed vulnerabilities (190,148)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-75077US | — | — | ||
A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /BSCE2.php. Such manipulati… | ||||
| CVE-2026-71424US | — | — | ||
Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/{persona_id} endpoints expose another user's OA… | ||||
| CVE-2026-69148US | — | — | ||
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, CreateModelVersion accepts a run_id or model_id af… | ||||
| CVE-2026-69146US | — | — | ||
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.13.0 until 3.15.0, LogInputs is absent from BEFORE_REQUEST_H… | ||||
| CVE-2026-64849US | — | KEV | ||
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/… | ||||
| CVE-2026-63178US | — | — | ||
Onyx is an open-source AI platform. Prior to 4.3.0, Onyx Enterprise Edition's PATCH /manage/admin/user-group/{user_group_id} and POST /manage/admin/user-group/{user_group_id}/add-u… | ||||
| CVE-2026-56677US | — | — | ||
9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl param… | ||||
| CVE-2026-45791US | — | — | ||
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's user.update procedure in apps/dokploy/server/api/routers/user.ts updates account.password… | ||||
| CVE-2026-45790US | — | — | ||
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's organization.inviteMember tRPC procedure in apps/dokploy/server/api/routers/organization.t… | ||||
| CVE-2026-11817US | — | — | ||
This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who i… | ||||
| CVE-2026-75531US | — | — | ||
Pandora contains a stored cross-site scripting (XSS) vulnerability in the rendering of URL observables. A URL extracted from or associated with an analyzed file was inserted direct… | ||||
| CVE-2026-75529US | — | — | ||
Pandora is affected by a stored cross-site scripting vulnerability in the PDF download functionality. The /task-download/<task_id>/.../pdf endpoint verifies that the submitted file… | ||||
| CVE-2026-75483US | — | — | ||
powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the versi… | ||||
| CVE-2026-75482US | — | — | ||
SWE-agent's trajectory inspector (sweagent inspector), confirmed in v1.1.0, is an HTTP server that joins request paths to the trajectory directory in its /trajectory/ handler witho… | ||||
| CVE-2026-75481US | — | — | ||
SkyPilot fails to validate that authenticated users are entitled to grant administrator roles when updating service account permissions. Attackers can create a service account, esc… | ||||
| CVE-2026-75480US | — | — | ||
OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls, allowing authenticated users to read all co-tenant records.… | ||||
| CVE-2026-75479US | — | — | ||
JimuReport contains an authentication bypass vulnerability in the report folder template listing endpoint that allows unauthenticated attackers to enumerate all reports and retriev… | ||||
| CVE-2026-75111US | — | — | ||
Evidently UI fails to properly validate the filename parameter in the dataset materialization endpoint, allowing unauthenticated attackers to read arbitrary files outside the works… | ||||
| CVE-2026-75110US | — | — | ||
MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is enabled (AUTH_ENABLED=true) but the undocumented, defaultless INTERNAL_SERVICE_SEC… | ||||
| CVE-2026-75109US | — | — | ||
Determined fails to authorize requests on the generic task kill, pause, and unpause endpoints in the API handlers. Authenticated attackers can disrupt other users' workloads by ter… | ||||