Astra Linux – vulnerability in cups

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and earlier, the CUPS daemon cupsd contains an authorization bypass vulnerability caused by case-insensitive username comparison during authorization checks. This vulnerability...

CVE-2026-110925

Rejected reason: CVE-2026-110925 has been marked as a duplicate of CVE-2026-106583...

pfsense-ovpn-connect-eval

abraxaslabs.tech · github.com/abraxas ·&...

CVE-2026-110925

A flaw was found in OpenSSH where a username provided via the ssh command line can contain a $ character or a non-trailing backslash. If a configuration expands %u within ProxyCommand or Match exec , these characters are passed directly into the shell, potentially leading to unintended command ex...

CVE-2026-110925

...

CVE-2026-110925

...

CVE-2026-110925: Improper Neutralization of Special Elements used in an OS Command

Rejected reason: CVE-2026-110925 has been marked as a duplicate of CVE-2026-106583...

UBUNTU-CVE-2026-88834

A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limite...

CVE-2026-110768

holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that authorizes senders by mutable username rather than only numeric id. Attackers who register a released username listed in allowFrom can submit turns to the bound workspace agent,...

CVE-2026-110768 holaOS through 2026.822.1 Authorization Bypass via Telegram Connector Username Allowlist

holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that authorizes senders by mutable username rather than only numeric id. Attackers who register a released username listed in allowFrom can submit turns to the bound workspace agent,...

EUVD-2026-101568

holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that authorizes senders by mutable username rather than only numeric id. Attackers who register a released username listed in allowFrom can submit turns to the bound workspace agent,...

CVE-2026-55572 e107: SQL injection in alt_auth plugin (otherdb / e107db backends) via login username

e107 is a content management system CMS. Prior to 2.3.7, the bundled altauth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107plugins/altauth/otherdbauth.php and e107plugins/altauth/e107dbauth.php. The login methods execute thos...

CVE-2026-55572 e107: SQL injection in alt_auth plugin (otherdb / e107db backends) via login username

e107 is a content management system CMS. Prior to 2.3.7, the bundled altauth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107plugins/altauth/otherdbauth.php and e107plugins/altauth/e107dbauth.php. The login methods execute thos...

SUSE CVE-2026-88834

A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limite...

Malicious code in @accenturecodefoundry/mfe-pot-shared-ui-scds-core (npm)

@accenturecodefoundry/mfe-pot-shared-ui-scds-core describes itself as “A simple placeholder for npm.” Its preinstall hook runs node index.js || true on npm install. Version 99.99.2 encodes the hostname and username as hexadecimal query parameters and sends them to...

PT-2026-114132

Name of the Vulnerable Software and Affected Versions holaOS versions prior to 2026.822.2 Description An authorization bypass exists in the channel-gateway Telegram connector. The system authorizes senders using a mutable username instead of relying solely on the numeric id. An attacker can...

CVE-2026-110768: Authentication Bypass by Spoofing

holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that authorizes senders by mutable username rather than only numeric id. Attackers who register a released username listed in allowFrom can submit turns to the bound workspace agent,...

CVE-2026-110256

Finsys Dockhand through 1.0.18 contains an LDAP injection vulnerability in the tryLdapAuth function in src/lib/server/auth.ts, which inserts the login username into the LDAP search filter without escaping wildcard characters. Unauthenticated attackers can submit incremental wildcard patterns such...

CVE-2026-110256

Finsys Dockhand versions through 1.0.18 are vulnerable to an LDAP injection flaw within the tryLdapAuth function located in src/lib/server/auth.ts. The root cause is the failure to escape wildcard characters when inserting the login username into the LDAP search filter. Unauthenticated attackers ...

EUVD-2026-100468

Finsys Dockhand through 1.0.18 contains an LDAP injection vulnerability in the tryLdapAuth function in src/lib/server/auth.ts, which inserts the login username into the LDAP search filter without escaping wildcard characters. Unauthenticated attackers can submit incremental wildcard patterns such...