166708 matches found
Traefik: Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth
Summary There is a high severity vulnerability in Traefik's BasicAuth, DigestAuth, and ForwardAuth middlewares. The fix for CVE-2026-33433 stripped canonical-cased spoofed identity headers e.g. X-Auth-User before writing Traefik's own value, but did not account for underscore-variant header names...
GHSA-X677-9FXG-V5C5 Traefik: Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth
Summary There is a high severity vulnerability in Traefik's BasicAuth, DigestAuth, and ForwardAuth middlewares. The fix for CVE-2026-33433 stripped canonical-cased spoofed identity headers e.g. X-Auth-User before writing Traefik's own value, but did not account for underscore-variant header names...
Traefik: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass
Summary There is a high severity vulnerability in Traefik's Kubernetes Ingress NGINX provider. When an Ingress uses the nginx.ingress.kubernetes.io/rewrite-target annotation with a regular expression that captures attacker-controlled text without requiring a path separator for example path /api...
ROOT-APP-MAVEN-CVE-2026-12802 CVE-2026-12802 in org.bouncycastle:bcpkix-jdk18on - Patched by Root
Root has patched CVE-2026-12802 in the org.bouncycastle:bcpkix-jdk18on package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2026-59639 CVE-2026-59639 in org.bouncycastle:bcpkix-jdk18on - Patched by Root
Root has patched CVE-2026-59639 in the org.bouncycastle:bcpkix-jdk18on package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2026-0636 CVE-2026-0636 in org.bouncycastle:bcprov-jdk18on - Patched by Root
Root has patched CVE-2026-0636 in the org.bouncycastle:bcprov-jdk18on package for Root:Maven. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2024-21534 CVE-2024-21534 in jsonpath-plus - Patched by Root
Root has patched CVE-2024-21534 in the jsonpath-plus package for Root:npm. Multiple fixed versions available...
CVE-2026-19041
A vulnerability has been found in MissionSquad mcp-api up to 1.11.8. The impacted element is the function this.packageService.installPackage of the file src/controllers/packages.ts of the component NPM Package Version Handler. The manipulation leads to command injection. It is possible to initiat...
EUVD-2026-53927
A vulnerability has been found in MissionSquad mcp-api up to 1.11.8. The impacted element is the function this.packageService.installPackage of the file src/controllers/packages.ts of the component NPM Package Version Handler. The manipulation leads to command injection. It is possible to initiat...
CVE-2026-19041 MissionSquad mcp-api NPM Package Version packages.ts this.packageService.installPackage command injection
A vulnerability has been found in MissionSquad mcp-api up to 1.11.8. The impacted element is the function this.packageService.installPackage of the file src/controllers/packages.ts of the component NPM Package Version Handler. The manipulation leads to command injection. It is possible to initiat...
Malicious code in agenttunnels (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 264711675c5edabf4f3d0b1d544ca8bade34057c973ca614c82bca3cf8bdd5a1 agenttunnels ships an MCP bridge whose customer-role tools accept payloads from a remote session worker agenttunnels-session.lakshman111.workers.dev...
CVE-2026-19038
CVE-2026-19038 affects MonomythDevelopment la-forge-mcp 1.0.0, specifically the screenshotElement function in src/index.ts of the screenshot_element Tool. The issue arises from manipulation of the argument output_name, enabling path traversal. The vulnerability is exploitable remotely via a netwo...
ROOT-OS-ALPINE-322-CVE-2026-3442 CVE-2026-3442 in binutils - Patched by Root
Root has patched CVE-2026-3442 in the binutils package for Root:Alpine:3.22. Multiple fixed versions available...
ROOT-OS-ALPINE-322-CVE-2025-69649 CVE-2025-69649 in binutils - Patched by Root
Root has patched CVE-2025-69649 in the binutils package for Root:Alpine:3.22. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2019-5413 CVE-2019-5413 in morgan - Patched by Root
Root has patched CVE-2019-5413 in the morgan package for Root:npm. Multiple fixed versions available...
EUVD-2026-53855
The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the chash parameter when operating in the Hybrid Flow. If an Apache CXF RP is integrated with a non-compliant or misconfigured Identity Provider IdP that omits the chash, the RP becomes vulnerable to Authorization Code...
ROOT-OS-ALPINE-315-CVE-2025-9230 CVE-2025-9230 in openssl - Patched by Root
Root has patched CVE-2025-9230 in the openssl package for Root:Alpine:3.15. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2015-9235 CVE-2015-9235 in jsonwebtoken - Patched by Root
Root has patched CVE-2015-9235 in the jsonwebtoken package for Root:npm. Multiple fixed versions available...