CVE-2026-75774

Karakeep up to 0.32.0 has an improper authentication flaw in its OAuth Sign-In logic (file apps/web/server/auth.ts). Attack complexity is high and no patch has been released yet, as the project has not responded to the issue report. Exploitation details are not publicly provided in the documents.

CVE-2026-75774 karakeep-app karakeep OAuth Sign-In auth.ts improper authentication

A vulnerability was determined in karakeep-app karakeep up to 0.32.0. The impacted element is an unknown function of the file apps/web/server/auth.ts of the component OAuth Sign-In. This manipulation causes improper authentication. It is possible to initiate the attack remotely. The complexity of...

CVE-2026-75774 karakeep-app karakeep OAuth Sign-In auth.ts improper authentication

A vulnerability was determined in karakeep-app karakeep up to 0.32.0. The impacted element is an unknown function of the file apps/web/server/auth.ts of the component OAuth Sign-In. This manipulation causes improper authentication. It is possible to initiate the attack remotely. The complexity of...

CVE-2026-50248

A flaw in Unbound allows a remote attacker to replace an authenticated or Response Policy Zone RPZ by spoofing DNS records for configured primary hostnames. This enables the attacker to impersonate the primary server, leading to DNS cache poisoning or traffic redirection. Mitigation Configure...

CVE-2026-75773 karakeep-app karakeep Login Endpoint auth.ts authorize excessive authentication

A vulnerability was found in karakeep-app karakeep up to 0.32.0. The affected element is the function authorize of the file apps/web/server/auth.ts of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed...

EUVD-2026-60580

A vulnerability was found in karakeep-app karakeep up to 0.32.0. The affected element is the function authorize of the file apps/web/server/auth.ts of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed...

CVE-2026-75773

The vulnerability is in the authorize function of apps/web/server/auth.ts in karakeep up to 0.32.0, allowing unlimited login attempts on the remote Login Endpoint. It is rated CVSS 3.7 (LOW) with high attack complexity. Upgrading to 0.33.0 (patch f7d042971d0d2bcc7119654830cf1eb93eabbf24) resolves...

CVE-2026-75773 karakeep-app karakeep Login Endpoint auth.ts authorize excessive authentication

A vulnerability was found in karakeep-app karakeep up to 0.32.0. The affected element is the function authorize of the file apps/web/server/auth.ts of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed...

CVE-2024-14046 OpenBoxes Document Upload Controller DocumentController.groovy DocumentController unrestricted upload

A security vulnerability has been detected in OpenBoxes up to 0.9.1. This issue affects the function DocumentController of the file grails-app/controllers/org/pih/warehouse/core/DocumentController.groovy of the component Document Upload Controller. The manipulation leads to unrestricted upload. I...

CVE-2024-14046 OpenBoxes Document Upload Controller DocumentController.groovy DocumentController unrestricted upload

A security vulnerability has been detected in OpenBoxes up to 0.9.1. This issue affects the function DocumentController of the file grails-app/controllers/org/pih/warehouse/core/DocumentController.groovy of the component Document Upload Controller. The manipulation leads to unrestricted upload. I...

CVE-2024-14046

OpenBoxes versions up to 0.9.1 have an unrestricted upload flaw in the DocumentController (DocumentController.groovy) enabling remote exploitation with proof-of-concept code disclosed publicly. CVSS 6.3 (MEDIUM). Upgrade to version 0.9.2 (patch commit e945d6bfcec29642f514e7d298dfba2cc6cd7cd4).

CVE-2024-14045

A weakness has been identified in OpenBoxes up to 0.9.2. This vulnerability affects unknown code of the file grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy of the component Product Supplier Edit Controller. Executing a manipulation can lead to improper authorization. The attack m...

EUVD-2024-55724

A weakness has been identified in OpenBoxes up to 0.9.2. This vulnerability affects unknown code of the file grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy of the component Product Supplier Edit Controller. Executing a manipulation can lead to improper authorization. The attack m...

CVE-2024-14045

OpenBoxes up to 0.9.2 is affected by an improper authorization vulnerability in the Product Supplier Edit Controller , specifically in the file grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy. A remote attacker with low privileges can exploit this flaw to bypass authorization cont...

CVE-2026-72381

A flaw was found in ksmbd, the in-kernel SMB3 server for Linux. A remote attacker can exploit a race condition by initiating two concurrent SMB2 durable reconnects with the same persistent ID. This can lead to a use-after-free error, where freed memory is accessed, potentially causing system...

CVE-2026-34789

A flaw was found in FreeCAD, a 3D parametric modeler. A remote attacker could exploit this vulnerability by tricking a user into opening a specially crafted FCStd document. When the document is restored, attacker-controlled module attributes are processed, leading to the execution of arbitrary...

CVE-2026-34398

A flaw was found in FreeCAD, a 3D parametric modeler. The BIM Project Manager's Load Template function does not properly validate certain properties within a project template. This vulnerability allows a remote attacker to embed malicious Python code into a specially crafted BIM project template...

CVE-2026-75151

A vulnerability has been found in SourceCodester Onlne Examination & Learning Management System 1.0. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be initiated remotely...

httpd: httpd: HTTP/2 Remote Denial of Service via compression bomb and Slowloris-style attack

A flaw was found in HTTP/2, affecting various web servers. A remote attacker can exploit this vulnerability by combining an HPACK compression bomb with a zero-byte flow-control window. This technique allows a small amount of data to expand into large memory allocations on the server, which are th...

CVE-2026-75093

A security vulnerability has been detected in sonos tract up to 0.23.4. This impacts the function Tensor::fromrawdtalign of the file data/src/tensor.rs of the component ONNX Initializer Loader. Such manipulation leads to incorrect calculation of buffer size. The attack may be launched remotely. T...