Lucene search
+L

169610 matches found

Github Security Blog
Github Security Blog
added 2026/08/06 7:28 p.m.11 views

Statamic: Unsafe method invocation via Antlers template resolution allows data destruction

Impact Manipulating user-supplied input incorporated into Antlers templates could result in the loss of content and assets. Exploitation requires a site to have templates that pass untrusted input into affected areas. It does not require authentication. Patches This has been fixed in 5.74.1 and...

6.5CVSS5.3AI score0.00296EPSS
SaveExploits0References2Affected Software1
Vulnrichment
Vulnrichment
added 2026/08/06 6:17 p.m.42 views

CVE-2026-65400

An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials...

5.5AI score0.00751EPSS
SaveExploits2References3
CVE
CVE
added 2026/08/06 6:17 p.m.456 views

CVE-2026-65400

CVE-2026-65400 is a pre-authentication/network-remote issue in macOS Screen Sharing. Affected: macOS Sequoia 15.7.9, Sonoma 14.8.9, Tahoe 26.6.1. Description: an authentication issue was fixed via improved state management, preventing unauthorized network authentication to Screen Sharing. Impact ...

9.8CVSS5.5AI score0.00751EPSS
SaveIn wildExploits2References7Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/08/06 6:17 p.m.14 views

CVE-2026-65400

An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials...

7.1CVSS5.5AI score0.00751EPSS
SaveExploits2References4
Cvelist
Cvelist
added 2026/08/06 6:17 p.m.45 views

CVE-2026-65400

An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials...

0.00751EPSS
SaveExploits2References3
OSV
OSV
added 2026/08/06 6:03 p.m.44 views

CVE-2026-19111 Insecure direct object reference in Strands Agents Tools memory tool namespace isolation

Insecure direct object reference in the mongodbmemory, elasticsearchmemory, and mem0memory tools in Amazon Strands Agents Tools before 0.8.3 might allow remote authenticated users to access, modify, or delete memories belonging to other tenants by influencing the LLM to emit tool calls with a...

8.6CVSS5.5AI score
SaveExploits0References5
CVE
CVE
added 2026/08/06 5:32 p.m.76 views

CVE-2026-3418

The CVE-2026-3418 entry concerns the System REST API in multiple WSO2 products that allows arbitrary file uploads due to insufficient validation of file type/destination. The vulnerability enables an authenticated publisher (admin with publisher privileges) to upload files to server-accessible lo...

9.1CVSS6.2AI score0.00521EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/06 5:32 p.m.29 views

CVE-2025-12317 Improper Token Revocation via SOAP Services in Multiple WSO2 Products Allows Retained Access Privileges

When internal roles are removed from a user within the WSO2 product, the system fails to invalidate any previously issued authentication tokens associated with that user. This vulnerability could allow users to retain their previous access privileges even after their roles have been revoked. As a...

5CVSS0.0024EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/06 5:32 p.m.53 views

CVE-2025-12317

Technical details are not publicly available in the provided documents. Monitor for updates.

5CVSS5.5AI score0.0024EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/06 5:31 p.m.29 views

CVE-2024-6541 Information Disclosure and Integrity Violation via Improper Message Context Handling in Multiple WSO2 Products

The Class Mediator fails to correctly validate or sanitize messageContext properties when they are used to populate dynamic values. This allows authenticated users to potentially access or modify data across different system invocations that should be isolated. This weakness can lead to the...

6.8CVSS0.00256EPSS
SaveExploits0References1
Fedora
Fedora
added 2026/08/06 5:17 p.m.11 views

[SECURITY] Fedora 44 Update: freeipa-4.13.2-1.fc44

IPA is an integrated solution to provide centrally managed Identity users, hosts, services, Authentication SSO, 2FA, and Authorization host access control, SELinux user roles, services. The solution provides features for further integration with Linux based clients SUDO, automount and integration...

8.8CVSS5.5AI score0.011EPSS
SaveExploits0
Cvelist
Cvelist
added 2026/08/06 4:54 p.m.29 views

CVE-2026-70635 TimescaleDB 2.29.1 Out-of-Bounds Read DoS via Bulk Dictionary Decompression Negative Index

TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability that allows authenticated attackers to cause query-result integrity failures or backend crashes by supplying a crafted Simple8b selector-11 value, which is stored in the signed int16 Arrow...

7.1CVSS0.00359EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/08/06 4:53 p.m.30 views

EUVD-2026-41940

Traefik: Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth...

10CVSS5.4AI score0.00208EPSS
SaveExploits0References7
OSV
OSV
added 2026/08/06 4:53 p.m.6 views

GHSA-X677-9FXG-V5C5 Traefik: Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth

Summary There is a high severity vulnerability in Traefik's BasicAuth, DigestAuth, and ForwardAuth middlewares. The fix for CVE-2026-33433 stripped canonical-cased spoofed identity headers e.g. X-Auth-User before writing Traefik's own value, but did not account for underscore-variant header names...

7.8CVSS5.6AI score0.00208EPSS
SaveExploits0References8
EUVD
EUVD
added 2026/08/06 4:51 p.m.17 views

EUVD-2026-47644

Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware...

7.8CVSS5.4AI score0.0041EPSS
SaveExploits0References7
OSV
OSV
added 2026/08/06 4:51 p.m.7 views

GHSA-CXJQ-MRR5-89RV Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware

Summary There is a critical authentication-bypass vulnerability in Traefik's ReplacePathRegex middleware. When it is configured with a regular expression that captures user-controlled path segments without a mandatory separator for example regex: "^/api.", replacement: "/$1", a crafted request ca...

9.1CVSS5.6AI score0.0041EPSS
SaveExploits0References8
EUVD
EUVD
added 2026/08/06 4:45 p.m.14 views

EUVD-2026-51815

Traefik: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass...

7.8CVSS5.4AI score0.00492EPSS
SaveExploits0References6
OSV
OSV
added 2026/08/06 4:45 p.m.9 views

GHSA-8RXV-JG7P-WVG3 Traefik: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass

Summary There is a high severity vulnerability in Traefik's Kubernetes Ingress NGINX provider. When an Ingress uses the nginx.ingress.kubernetes.io/rewrite-target annotation with a regular expression that captures attacker-controlled text without requiring a path separator for example path /api...

7.8CVSS5.7AI score0.00492EPSS
SaveExploits0References5
Github Security Blog
Github Security Blog
added 2026/08/06 4:45 p.m.20 views

Traefik: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass

Summary There is a high severity vulnerability in Traefik's Kubernetes Ingress NGINX provider. When an Ingress uses the nginx.ingress.kubernetes.io/rewrite-target annotation with a regular expression that captures attacker-controlled text without requiring a path separator for example path /api...

7.8CVSS5.7AI score0.00492EPSS
SaveExploits0References5Affected Software1
Vulnrichment
Vulnrichment
added 2026/08/06 4:34 p.m.8 views

CVE-2026-71326 Traefik: BasicAuth singleflight key collision allows authenticated identity spoofing

Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.6.25 and 3.7.10, Traefik's BasicAuth middleware in pkg/middlewares/auth/basicauth.go deduplicates concurrent password checks with a singleflight key built from the delimiter-free concatenation of password and...

2.1CVSS5.2AI score0.00356EPSS
SaveExploits0References5
Rows per page
Query Builder