CVE-2026-85430

MOOS essential-moos (through version 10.0.1) contains an authentication bypass in the pShare component, which accepts UDP datagrams from any source and republishes them with the attacker-claimed identity intact. An unauthenticated network attacker can inject crafted messages into the local MOOS c...

CVE-2026-85430 MOOS essential-moos through 10.0.1 pShare Unauthenticated UDP Datagram Republishing

MOOS essential-moos through 10.0.1 contains an authentication bypass vulnerability in pShare that accepts UDP datagrams from any source and republishes them with the attacker-claimed identity intact. Attackers can send crafted UDP datagrams to pShare input routes to inject messages into the local...

CVE-2026-85430 MOOS essential-moos through 10.0.1 pShare Unauthenticated UDP Datagram Republishing

MOOS essential-moos through 10.0.1 contains an authentication bypass vulnerability in pShare that accepts UDP datagrams from any source and republishes them with the attacker-claimed identity intact. Attackers can send crafted UDP datagrams to pShare input routes to inject messages into the local...

CVE-2026-85428 MOOS core-moos through 10.4.0 MOOSDB HTTP Server Unauthenticated Variable Write

MOOS core-moos through 10.4.0 contains an authentication bypass vulnerability in the optional MOOSDB HTTP server that allows unauthenticated clients to write variables. Attackers can send HTTP requests with variable names and values to the MOOSDB HTTP server port to modify MOOS variables includin...

CVE-2026-85428

MOOS core-moos through 10.4.0 contains an authentication bypass in its optional MOOSDB HTTP server . Unauthenticated clients can send HTTP requests with variable names and values to the MOOSDB HTTP server port, allowing them to modify MOOS variables including actuator and override commands withou...

GHSA-3MP7-4RH5-JRV9 SiYuan: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port proxy

CVE: This vulnerability corresponds to CVE-2026-72809. Summary The kernel's CheckAuth grants RoleAdministrator to any request whose RemoteAddr is loopback 127.0.0.1, for a specific set of endpoints, and these localhost bypasses sit outside the accessAuthCode gate so they apply even when an access...

EUVD-2026-57410

SiYuan: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port proxy...

EUVD-2026-58625

SiYuan: Publish-boundary bypass via WebSocket broadcast: anonymous readers receive a live unfiltered feed of all edits including protected/forbidden documents publish mode...

GHSA-MW8R-MW84-88V2 SiYuan: Publish-boundary bypass via WebSocket broadcast: anonymous readers receive a live unfiltered feed of all edits including protected/forbidden documents (publish mode)

CVE: This vulnerability corresponds to CVE-2026-72810. Summary WebSocket sessions established through the publish surface port 6808, RoleReader anonymous when Publish.Auth.Enable is false are added to the same broadcast session pool as authenticated sessions. The kernel's broadcast functions push...

libevent: Libevent: HTTP header handling bugs create risk of access control bypass.

A flaw was found in libevent. The evhttpdecodeuriinternal function in http.c decodes percent-encoded %00 bytes into literal NUL characters without rejecting them, allowing an attacker to craft a URI such as /admin/secret%00.jpg where extension-based access checks see .jpg but the server processes...

Important: Red Hat Security Advisory: Satellite 6.18.9 Async Update

A new release is now available for Red Hat Satellite 6.18 for RHEL 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

ruby-jwt: ruby-jwt: Authentication bypass due to empty key in HMAC verification

A flaw was found in ruby-jwt, a Ruby implementation of the RFC 7519 OAuth JSON Web Token JWT standard. A remote attacker can exploit this vulnerability by crafting a malicious token that is accepted due to an empty key being used in the HMAC Hash-based Message Authentication Code digest calculati...

GHSA-7J72-F6WG-CXW6 SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode)

CVE: This vulnerability corresponds to CVE-2026-68584. Summary SiYuan's publish mode defines a "protected" access level: a document that is publicly listed but requires a password to read per the product's own UI help text, protected = "Publicly visible, requires password to access". The password...

SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode)

CVE: This vulnerability corresponds to CVE-2026-68584. Summary SiYuan's publish mode defines a "protected" access level: a document that is publicly listed but requires a password to read per the product's own UI help text, protected = "Publicly visible, requires password to access". The password...

CVE-2026-85061

MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanitize in src/util/dom.ts iterates elem.attributes as a live NamedNodeMap while removeAttributes removes attributes from the same collection, shifting indexes and skipping an adjacent dangerous...

DEBIAN-CVE-2026-84185

A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption JOSE standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the...

CVE-2026-84185

A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption JOSE standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the...

CVE-2026-84185

A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption JOSE standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the...

CVE-2026-84185 Jwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verification

A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption JOSE standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the...

CVE-2026-84185

CVE-2026-84185 affects the jwcrypto library, a Python implementation of the JOSE (JSON Object Signing and Encryption) standards. The flaw occurs during verification of a General JSON Serialization JWS against a key set (JWKset): due to a coding error, the library fails to correctly match the key ...