208457 matches found
SUSE CVE-2026-28735
Mattermost versions 11.6.x = 11.6.0, 11.5.x = 11.5.3, 11.4.x = 11.4.4, 10.11.x = 10.11.14 fail to validate the OAuth token scope on the callback which allows an authenticated Mattermost user to gain access to private repositories via modifying the scope parameter in the GitHub authorization URL...
SUSE CVE-2026-28741
Mattermost versions 10.11.x = 10.11.12, 11.5.x = 11.5.0, 11.4.x = 11.4.2, 11.3.x = 11.3.2 fail to validate CSRF tokens on an authentication endpoint which allows an attacker to update a user's authentication method via a CSRF attack by tricking a user into visiting a malicious page. Mattermost...
SUSE CVE-2026-28744
Gitea versions up to and including 1.26.1 allow Git smart HTTP requests authenticated with bearer tokens to bypass repository token scope checks...
SUSE CVE-2026-28759
Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13, 11.4.x = 11.4.3 fail to validate that a remote cluster has access to a channel before processing membership removal requests during shared channel membership sync, which allows a malicious remote cluster to remove any user from any channel,...
GHSA-4RCQ-JV2F-898J
creationtimestamp| type| source ---|---|--- 2026-07-30 16:49:58+00:00| seen| https://gist.github.com/tu-trinh-scale/6952882fc494bc673397ec58f04a6e92 2026-07-30 19:33:45+00:00| seen| https://gist.github.com/tu-trinh-scale/cdec105f804c8b4962d64774b7f2237d 2026-07-30 19:34:08+00:00| seen|...
GHSA-VW27-FWJF-5QXM
creationtimestamp| type| source ---|---|--- 2026-07-30 16:49:48+00:00| seen| https://gist.github.com/tu-trinh-scale/6952882fc494bc673397ec58f04a6e92 2026-07-30 19:33:36+00:00| seen| https://gist.github.com/tu-trinh-scale/cdec105f804c8b4962d64774b7f2237d 2026-07-30 19:33:48+00:00| seen|...
SUSE CVE-2026-50149
Contour is a Kubernetes ingress controller using Envoy proxy. In versions 1.23.0 through 1.33.4, when an HTTPProxy is configured with incompatible combination of both .spec.virtualhost.tls.enableFallbackCertificate: true and .spec.virtualhost.jwtProviders, Contour does not reject the configuratio...
SUSE CVE-2026-53487
Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...
SUSE CVE-2026-56443
Token public-only scope bypassed on Limited-visibility owners Repository + Package categories - residual after CVE-2026-25714 / PR 37118...
CVE-2026-67438
creationtimestamp| type| source ---|---|--- 2026-07-30 16:35:33+00:00| published-proof-of-concept| https://github.com/OliveTin/OliveTin/security/advisories/GHSA-xc5w-4v5w-7x65 2026-07-31 08:32:20+00:00| seen| https://gist.github.com/alon710/006ebdb624799640fa8e05feb88f3b11...
CVE-2026-67427
creationtimestamp| type| source ---|---|--- 2026-07-30 16:35:12+00:00| published-proof-of-concept| https://github.com/flytohub/flyto-core/security/advisories/GHSA-hr7p-wg7r-hg9m 2026-07-30 23:32:08+00:00| seen| https://gist.github.com/alon710/937397e52a8e0970b2abb603a8f2aff3 2026-07-31...
CVE-2026-67425
creationtimestamp| type| source ---|---|--- 2026-07-30 16:35:10+00:00| published-proof-of-concept| https://github.com/flytohub/flyto-core/security/advisories/GHSA-qq9q-xgm3-xv9g 2026-07-30 22:32:21+00:00| seen| https://gist.github.com/alon710/118a4cdb35451ca1b82ac84f2659aa47 2026-07-31...
CVE-2026-54522
CVE-2026-54522 affects MessagePack for Ruby prior to 1.8.2, where MessagePack::Buffer#clear can leave internal rmem pointers stale after a chunk return, enabling a subsequent Buffer#write to alias the freed page and potentially disclose or corrupt cross-buffer data. Root cause: stale rmem_last/rm...
GHSA-PGWH-4JJ4-QM8V
creationtimestamp| type| source ---|---|--- 2026-07-30 16:30:59+00:00| seen| https://gist.github.com/alon710/abbfb678b2ea15b959183e89124a0f42...
CVE-2026-59326
creationtimestamp| type| source ---|---|--- 2026-07-30 16:15:18+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/spring-security-advisory-av26-759...
CVE-2026-59328
creationtimestamp| type| source ---|---|--- 2026-07-30 16:15:15+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/spring-security-advisory-av26-759...
CVE-2026-59327
creationtimestamp| type| source ---|---|--- 2026-07-30 16:15:13+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/spring-security-advisory-av26-759...
GHSA-C9HR-64H3-GXPC
creationtimestamp| type| source ---|---|--- 2026-07-30 15:31:53+00:00| seen| https://gist.github.com/alon710/5c4b46a299dac54e7caa99802f7ad9a8...
External Control of File Name or Path
Overview flyto-core is an A workflow engine with 412 built-in modules. Trace every step. Replay from any point. Affected versions of this package are vulnerable to External Control of File Name or Path via the image.download process and other file-writing modules, which allow attacker-controlled...
