9454 matches found
MAL-2026-11902 Malicious code in @servicetitan/microfront-auth (npm)
npm/@servicetitan/microfront-auth is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
MAL-2026-11553 Malicious code in @arv-bedrock/auth (npm)
npm/@arv-bedrock/auth is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished b...
Malicious code in @arv-bedrock/auth (npm)
npm/@arv-bedrock/auth is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished b...
Malicious code in @arv-bedrock/auth-sso-backend (npm)
npm/@arv-bedrock/auth-sso-backend is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
PYSEC-2026-3578 linuxfabrik-lib: fetch() forwards credential headers across a cross-origin redirect
Summary lib.url.fetch follows HTTP redirects followredirects=True. httpx strips only Authorization and Cookie when a redirect crosses the origin, so any other caller-supplied credential header a session token such as Redfish's X-Auth-Token, an API key, ... was still sent to the redirect target. A...
RockyLinux 8 : mingw-glib2 (RLSA-2026:49512)
The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:49512 advisory. glib: GLib: Buffer underflow in GVariant parser leads to heap corruption CVE-2025-14087 glib: buffer over-read in glib/gvariant-serialiser.c via...
PT-2026-67818
Name of the Vulnerable Software and Affected Versions SSSD affected versions not specified Description A flaw exists in the PAM responder where the extract authtok v1 function fails to validate the auth token length field against the remaining buffer size before processing. A local attacker can...
CVE-2026-66901: Server-Side Request Forgery (SSRF)
Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON. The URLs the library requests are read from the credentials JSON, and their hosts were not checked against the universe domain before the...
CVE-2026-66902: Improper Neutralization of Special Elements used in an OS Command
Google::Auth versions before 0.06 for Perl run a command named in an externalaccount credentials JSON via an ungated system call. The Pluggable subclass reads credentialsource.executable.command from the credentials JSON and runs it as system$command, a single argument call that passes the whole...
JLSEC-2026-1122
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.14 and 2.12.5, if the nats-server has the "leafnode" configuration enabled not default, then anyone who can connect can crash the nats-server by triggering a panic. This happens...
JLSEC-2026-1126
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a client which can connect to the leafnode port can crash the nats-server with a certain malformed message pre-authentication. Versions 2.11.15 and 2.12.6 contain ...
JLSEC-2026-1135 Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input...
Issue Summary: Cryptographic Message Services CMS processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises. Impact Summary: Attackers making use of these vulnerabilities may achieve...
AZL-94517 CVE-2026-18651 affecting package 389-ds-base 3.1.1-12
A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account-lock check. If the account is subsequently found to be locked, the bind is reported as failed to the client, but the already-installed...
CVE-2026-68586 SiYuan before v3.7.3 Content Disclosure via getBacklinkDoc
SiYuan before v3.7.3 fails to apply publish-access filters to the getBacklinkDoc and getBackmentionDoc content endpoints /api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc. While the corresponding backlink list endpoints filter publish-forbidden documents, the content endpoints gated only by...
Exploit for CVE-2026-60004
CVE-2026-60004 — Gitea Pre-Auth Remote Code Execution CVSS 9...
Improper Validation of Integrity Check Value
Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in CMS AuthEnvelopedData recipient processing, where AbstractRecipient and its recipient classes such as JceKeyTransRecipient and BcKeyTransRecipient take the AEAD tag length from the...
Improper Validation of Integrity Check Value
Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in CMS AuthEnvelopedData recipient processing, where AbstractRecipient and its recipient classes such as JceKeyTransRecipient and BcKeyTransRecipient take the AEAD tag length from the...
Improper Validation of Integrity Check Value
Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in CMS AuthEnvelopedData recipient processing, where AbstractRecipient and its recipient classes such as JceKeyTransRecipient and BcKeyTransRecipient take the AEAD tag length from the...
Authorization Bypass
@better-auth/stripe is vulnerable to Authorization Bypass. The vulnerability is due to inconsistent organization ID validation between the middleware and request handler, allowing authenticated users to perform unauthorized subscription actions and access billing information for other organizatio...
