CVE-2026-12342 SailPoint IdentityIQ Improper Form Validation Vulnerability

This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated user remote code execution on the IdentityIQ server due to improper input validation of submitted web service API content...

EUVD-2026-88337

This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated user remote code execution on the IdentityIQ server due to improper input validation of submitted web service API content...

CVE-2026-12342

This vulnerability affects all versions of SailPoint IdentityIQ . It allows an unauthenticated user to achieve remote code execution (RCE) on the IdentityIQ server. The root cause is identified as improper input validation of submitted web service API content. No specific exploit links or patch v...

CVE-2026-12342 SailPoint IdentityIQ Improper Form Validation Vulnerability

This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated user remote code execution on the IdentityIQ server due to improper input validation of submitted web service API content...

CVE-2021-4191-EXPLOIT

CVE-2021-4191 - GitLab ユーザー列挙 GitLabは、Gitリポジトリマネージャーを提供し、継続的インテグレーション、課題追跡、コードレビューなどの機能を統合した、広く利用されているWebベースのDevOpsライフサイクルツールです。GraphQL APIは、プログラム的にGitLabと対話し、さまざまな操作を実行できる強力なインターフェースです。 GitLab CVE-2021-4191脆弱性は、特定のバージョンのGitLabにおけるGraphQL...

CVE-2020-13945-EXPLOIT

CVE-2020-13945 - Apache APISIX リモートコード実行（RCE） このリポジトリには、Apache APISIX の脆弱性に対する概念実証（PoC）エクスプロイトが含まれています。この脆弱性は、Admin API が有効でアクセス IP 制限ルールが削除されている場合に発生し、デフォルトトークンを使用して APISIX の管理データにアクセスできるようになります。これはバージョン 1.2、1.3、1.4、および 1.5 に影響します。 目次 概要 影響を受けるバージョン セットアップ 使用方法 対策 免責事項 概要 Apache APISIX...

grafana: grafana: Authorization bypass via missing destination folder permission check

A flaw was found in Grafana. The application fails to verify creation permissions on destination folders during panel update operations. An authenticated user with edit permissions in one folder can exploit this vulnerability through the library elements API to move a library panel into a folder...

Important: Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.20.1

cert-manager Operator for Red Hat OpenShift 1.20.1 The cert-manager Operator for Red Hat OpenShift builds on top of Kubernetes, introducing certificate authorities and certificates as first-class resource types in the Kubernetes API. This makes it possible to provide certificates-as-a-service to...

github.com/openfga/openfga: OpenFGA: Unauthorized access due to ListUsers API returning deliberately excluded users.

A flaw was found in OpenFGA, an authorization and permission engine. The ListUsers application programming interface API could incorrectly return users who should have been excluded from authorization decisions. This vulnerability arises when complex authorization rules, involving both exclusions...

Akamai Joins Athena Coalition to Shield Users from New Vulnerabilities

Akamai joins Chainguard’s Athena Coalition, verifying that Akamai App & API Protector customers are automatically shielded from newly disclosed vulnerabilities...

CVE-2026-101068 dbgate Create Connection Endpoint zipJsonLinesData.js zipJsonLinesData path traversal

A security flaw has been discovered in dbgate up to 7.3.1. This impacts the function zipJsonLinesData of the file packages/api/src/utility/zipJsonLinesData.js of the component Create Connection Endpoint. Performing a manipulation of the argument filePath results in path traversal. Remote...

CVE-2026-82930 Missing Authentication in mH-DEVELOPER

mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated attacker on the LAN can query these endpoints, access system information, and send raw control commands to...

CVE-2026-82930 Missing Authentication in mH-DEVELOPER

mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated attacker on the LAN can query these endpoints, access system information, and send raw control commands to...

CVE-2026-82930

The mH-DEVELOPER smart home module contains a vulnerability where the authorization middleware fails to verify tokens. This flaw leaves all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated attacker on the LAN can exploit this to query endpoints, access system...

Important: Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.20.1

cert-manager Operator for Red Hat OpenShift 1.20.1 The cert-manager Operator for Red Hat OpenShift builds on top of Kubernetes, introducing certificate authorities and certificates as first-class resource types in the Kubernetes API. This makes it possible to provide certificates-as-a-service to...

EUVD-2026-88217

A security vulnerability has been detected in refly-ai refly up to 1.1.0. This issue affects some unknown processing of the file apps/api/src/modules/config/app.config.ts of the component JWT Token Handler. The manipulation with the input test leads to hard-coded credentials. It is possible to...

CVE-2026-101052 refly-ai refly JWT Token app.config.ts hard-coded credentials

A security vulnerability has been detected in refly-ai refly up to 1.1.0. This issue affects some unknown processing of the file apps/api/src/modules/config/app.config.ts of the component JWT Token Handler. The manipulation with the input test leads to hard-coded credentials. It is possible to...

CVE-2026-101052 refly-ai refly JWT Token app.config.ts hard-coded credentials

A security vulnerability has been detected in refly-ai refly up to 1.1.0. This issue affects some unknown processing of the file apps/api/src/modules/config/app.config.ts of the component JWT Token Handler. The manipulation with the input test leads to hard-coded credentials. It is possible to...

CVE-2026-82379 Apache Roller: WSSE digest authentication headers can be replayed

Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest authentication header to replay it and gain the victim's AtomPub authority, because the authentication does not enforce nonce uniqueness or timestamp freshness. Only installations th...

CVE-2026-82379 Apache Roller: WSSE digest authentication headers can be replayed

Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest authentication header to replay it and gain the victim's AtomPub authority, because the authentication does not enforce nonce uniqueness or timestamp freshness. Only installations th...