GHSA-CXJQ-MRR5-89RV Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware

Summary There is a critical authentication-bypass vulnerability in Traefik's ReplacePathRegex middleware. When it is configured with a regular expression that captures user-controlled path segments without a mandatory separator for example regex: "^/api.", replacement: "/$1", a crafted request ca...

GHSA-3CCP-42PG-HGV6

creationtimestamp| type| source ---|---|--- 2026-08-06 16:31:29+00:00| seen| https://gist.github.com/alon710/44f5ca1944b401eb63cfb2fdd265ca45...

CVE-2026-71324

creationtimestamp| type| source ---|---|--- 2026-08-06 16:31:29+00:00| seen| https://gist.github.com/alon710/44f5ca1944b401eb63cfb2fdd265ca45 2026-08-06 16:35:02+00:00| published-proof-of-concept| https://github.com/traefik/traefik/security/advisories/GHSA-3ccp-42pg-hgv6...

CVE-2026-9203

creationtimestamp| type| source ---|---|--- 2026-08-06 16:15:59+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/progress-security-advisory-av26-781...

CVE-2021-20334

creationtimestamp| type| source ---|---|--- 2026-08-06 16:15:35+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-218-01 2026-08-10 04:02:55+00:00| seen| https://bsky.app/profile/cyfar.ca/post/3msp7qvoyw624...

CVE-2021-32036

creationtimestamp| type| source ---|---|--- 2026-08-06 16:15:22+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-218-01...

CVE-2020-7923

creationtimestamp| type| source ---|---|--- 2026-08-06 16:15:18+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-218-01...

CVE-2020-7921

creationtimestamp| type| source ---|---|--- 2026-08-06 16:15:10+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-218-01...

CVE-2026-27871

creationtimestamp| type| source ---|---|--- 2026-08-06 16:15:03+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-218-02...

Important: Red Hat Security Advisory: RHEL AI 3.4 RPM runtime CVE fix - aom

AIPCC Security Alerts identified CVEs in the 3.4 release of base-images. The CVEs are listed with a severity level of "Important" or higher. RPM packages are internal build artifacts and not supported on their own. They are only supported as part of the Red Hat AI application platform...

CVE-2026-61466

creationtimestamp| type| source ---|---|--- 2026-08-06 15:50:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msgffrr5pn2s 2026-08-06 21:05:57+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/4hv3t36k4hvzo 2026-08-07 09:37:07+00:00| seen|...

GHSA-3X6R-WXXG-53VV

creationtimestamp| type| source ---|---|--- 2026-08-06 15:31:19+00:00| seen| https://gist.github.com/alon710/164398037554120d630a453295ebf3cc...

DEBIAN-CVE-2026-32327

A bug in APR-util version 1.6.3 and earlier allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the aprxmlquoteelem function. Users are recommended to upgrade to version 1.6.4, which fixes this issue...

CVE-2026-18427 @fastify/static vulnerable to route guard bypass via non-canonical path segments

@fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. The static file handler rejected only parent directory segments, but it did not canonicalize dot segments, duplicate slashes, encoded dots, or backslashes before route matching and before delegatin...

GHSA-8V25-V8P6-QF7V

creationtimestamp| type| source ---|---|--- 2026-08-06 14:32:29+00:00| seen| https://gist.github.com/alon710/24bef11b86322cc9770e86fa941513f4...

CVE-2026-66457

CVE-2026-66457 describes an unauthenticated cross-site scripting (XSS) vulnerability in the WordPress Events Manager plugin version ≤ 7.4.1. The issue is identified as an XSS flaw; no root-cause specifics are provided in the documents. Exploitation status and precise impact vectors are not detail...

@holocronlab/botruntime-adk (2.5.4), @holocronlab/brt (0.9.3) potentially affected by unknown CVE via @holocronlab/botruntime-runtime (2.5.4)

@holocronlab/botruntime-runtime NPM version 2.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on @holocronlab/botruntime-runtime and may be impacted: - @holocronlab/botruntime-adk 2.5.4 - @holocronlab/brt 0.9.3 Source cves: unknown CVE Source advisory...

@holocronlab/botruntime-adk (2.4.2), @holocronlab/brt (0.7.25) potentially affected by unknown CVE via @holocronlab/botruntime-runtime (2.4.2)

@holocronlab/botruntime-runtime NPM version 2.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on @holocronlab/botruntime-runtime and may be impacted: - @holocronlab/botruntime-adk 2.4.2 - @holocronlab/brt 0.7.25 Source cves: unknown CVE Source advisor...

@holocronlab/botruntime-adk (2.2.5), @holocronlab/brt (0.7.5) potentially affected by unknown CVE via @holocronlab/botruntime-runtime (2.2.5)

@holocronlab/botruntime-runtime NPM version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on @holocronlab/botruntime-runtime and may be impacted: - @holocronlab/botruntime-adk 2.2.5 - @holocronlab/brt 0.7.5 Source cves: unknown CVE Source advisory...

@holocronlab/botruntime-adk (2.6.4), @holocronlab/brt (0.9.8) potentially affected by unknown CVE via @holocronlab/botruntime-runtime (2.6.4)

@holocronlab/botruntime-runtime NPM version 2.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on @holocronlab/botruntime-runtime and may be impacted: - @holocronlab/botruntime-adk 2.6.4 - @holocronlab/brt 0.9.8 Source cves: unknown CVE Source advisory...