Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via the CreateAccessToken process. An attacker can gain elevated privileges by supplying a restricted token in the Authorization: Basic :x-oauth-basic format, which bypasses authentication checks and allows...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via the CreateAccessToken process. An attacker can gain elevated privileges by supplying a restricted token in the Authorization: Basic :x-oauth-basic format, which bypasses authentication checks and allows...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via the CreateAccessToken process. An attacker can gain elevated privileges by supplying a restricted token in the Authorization: Basic :x-oauth-basic format, which bypasses authentication checks and allows...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via the CreateAccessToken process. An attacker can gain elevated privileges by supplying a restricted token in the Authorization: Basic :x-oauth-basic format, which bypasses authentication checks and allows...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via the CreateAccessToken process. An attacker can gain elevated privileges by supplying a restricted token in the Authorization: Basic :x-oauth-basic format, which bypasses authentication checks and allows...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via the CreateAccessToken process. An attacker can gain elevated privileges by supplying a restricted token in the Authorization: Basic :x-oauth-basic format, which bypasses authentication checks and allows...

GHSA-683J-3FF6-HH2X Gitea: Privilege Escalation via Access Token Scope Escalation in API

Gitea's API endpoint for creating Personal Access Tokens POST /users/username/tokens is protected by a middleware reqBasicOrRevProxyAuth that is intended to require password-based authentication, preventing a compromised token from being used to mint new ones. However, when a token is passed in t...

GHSA-P4MJ-98MV-XQ26 Gitea: Private Repository Existence Disclosure via go-get Meta Endpoint

| Field | Value | |-------|-------| | Affected File | routers/web/repo/githttp.go, services/context/repo.go | | Affected Functions | httpBase, EarlyResponseForGoGetMeta | | Affected Lines | githttp.go:63–66, services/context/repo.go:374–396 | | Prerequisite | None — fully unauthenticated | ---...

Gitea: Private Repository Existence Disclosure via go-get Meta Endpoint

| Field | Value | |-------|-------| | Affected File | routers/web/repo/githttp.go, services/context/repo.go | | Affected Functions | httpBase, EarlyResponseForGoGetMeta | | Affected Lines | githttp.go:63–66, services/context/repo.go:374–396 | | Prerequisite | None — fully unauthenticated | ---...

CVE-2026-50759

An issue in exo-explore exo 1.0.69 allows a remote attacker to escalate privileges via the GET /state and DELETE /instance/instanceid endpoints with no authentication...

CVE-2026-16317 Silent Drop of TLS 1.3 Encrypted Records in s2n-tls

Missing validation of the outer contenttype byte on TLS 1.3 encrypted records in s2n-tls allows an active man-in-the-middle to silently discard individual application data records without either endpoint detecting the modification. RFC 8446 Section 5.2 requires that the outer contenttype of all...

CVE-2026-56144 Incorrect Authorization in Elasticsearch Leading to Information Disclosure

Incorrect Authorization CWE-863 in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authorization controls in the ingest simulation feature. By targeting indices they are not authorized to access directly, the user can cause those indices'...

AZL-93237 CVE-2026-12547 affecting package libsoup 3.4.4-16

SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority host:port. When the proxy configuration changes e.g., via system settings or WPAD, cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, leaking credentials...

CVE-2026-12547 Libsoup: information disclosure in libsoup via soupauthmanager proxy credential leak on proxy switch

SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority host:port. When the proxy configuration changes e.g., via system settings or WPAD, cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, leaking credentials...

CVE-2026-12547 Libsoup: information disclosure in libsoup via soupauthmanager proxy credential leak on proxy switch

SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority host:port. When the proxy configuration changes e.g., via system settings or WPAD, cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, leaking credentials...

ANT-2026-CJQWKW82 · postgres/postgres · Denial-of-service

denial-of-service high CVE-2026-6479 GHSA-hwfh-mh4f-m67f Severity Claude high · Security research firm high · Maintainer high Discovered by Claude Opus 4.6 REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Calif. ANT-2026-CJQWKW82: Pre-auth unbounded...

Exploit for CVE-2026-60137

How does this work at all !plotd...

EUVD-2026-46344

HCL MyCloud was affected with Cookie Attribute Path Not Set. It may increase the risk of unauthorized access to session data or authentication tokens...

CVE-2026-56581 HCL MyCloud was affected with Cookie Attribute Path Not Set

HCL MyCloud was affected with Cookie Attribute Path Not Set. It may increase the risk of unauthorized access to session data or authentication tokens...

CVE-2026-16454

In Eclipse hawkBit versions 1.0.3 and prior, a privilege escalation vulnerability CWE-284 / CWE-862 has been identified in the Direct Device Integration DDI Controller. This vulnerability allows an authenticated device to escalate its permissions and bypass the strict boundaries of its assigned...