GuvenliWebYazilimiGelistirme-CipherNone-

🛡️ CipherNone: JWT "alg: none" Vulnerability & Hardening Lab...

EUVD-2026-19062

A vulnerability was detected in badlogic pi-mono up to 0.58.4. This issue affects some unknown processing of the file packages/mom/src/slack.ts of the component pi-mom Slack Bot. The manipulation results in authentication bypass using alternate channel. The attack can be executed remotely. The...

CVE-2026-5557

A vulnerability was detected in badlogic pi-mono up to 0.58.4. This issue affects some unknown processing of the file packages/mom/src/slack.ts of the component pi-mom Slack Bot. The manipulation results in authentication bypass using alternate channel. The attack can be executed remotely. The...

CVE-2026-5557

The CVE-2026-5557 entry concerns badlogic pi-mono up to version 0.58.4, affecting the pi-mom Slack Bot component’s file packages/mom/src/slack.ts. The documented issue results in an authentication bypass via an alternate channel, with remote execution possible. Public exploitation is noted. No ve...

CVE-2026-5557

A vulnerability was detected in badlogic pi-mono up to 0.58.4. This issue affects some unknown processing of the file packages/mom/src/slack.ts of the component pi-mom Slack Bot. The manipulation results in authentication bypass using alternate channel. The attack can be executed remotely. The...

CVE-2026-5557 badlogic pi-mono pi-mom Slack Bot slack.ts authentication bypass

A vulnerability was detected in badlogic pi-mono up to 0.58.4. This issue affects some unknown processing of the file packages/mom/src/slack.ts of the component pi-mom Slack Bot. The manipulation results in authentication bypass using alternate channel. The attack can be executed remotely. The...

CVE-2026-5557 badlogic pi-mono pi-mom Slack Bot slack.ts authentication bypass

A vulnerability was detected in badlogic pi-mono up to 0.58.4. This issue affects some unknown processing of the file packages/mom/src/slack.ts of the component pi-mom Slack Bot. The manipulation results in authentication bypass using alternate channel. The attack can be executed remotely. The...

Fortinet Patches Actively Exploited CVE-2026-35616 in FortiClient EMS

Fortinet has released out-of-band patches for a critical security flaw impacting FortiClient EMS that it said has been exploited in the wild. The vulnerability, tracked as CVE-2026-35616 CVSS score: 9.1, has been described as a pre-authentication API access bypass leading to privilege escalation...

PT-2026-30507

eDirectory contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to bypass administrator authentication and disclose sensitive files by injecting SQL code into parameters. Attackers can exploit the key parameter in the login endpoint with union-based SQL injection t...

OSS Weekend 安全漏洞

OSS Weekend is an AI development and LLM deployment management tool developed by Mario Zechner as a personal project. Versions of OSS Weekend prior to 0.58.4 contained security vulnerabilities, which were caused by an authentication bypass vulnerability in the packages/mom/src/slack.ts file...

PT-2026-30427

A vulnerability was detected in badlogic pi-mono up to 0.58.4. This issue affects some unknown processing of the file packages/mom/src/slack.ts of the component pi-mom Slack Bot. The manipulation results in authentication bypass using alternate channel. The attack can be executed remotely. The...

eDirectory SQL注入漏洞

eDirectory is an online directory website operated by eDirectory Inc. eDirectory has SQL injection vulnerabilities; these vulnerabilities stem from multiple SQL injection flaws, which could allow unverified attackers to bypass administrator authentication and disclose sensitive files...

LightRAG: Hardcoded JWT Signing Secret Allows Authentication Bypass

Subject: Security Vulnerability Report Hardcoded JWT Secret CVE-2026-30762 Hi HKUDS team, I'm writing to report a security vulnerability I discovered in LightRAG v1.4.10. This has been assigned CVE-2026-30762 by MITRE. Vulnerability: Hardcoded JWT signing secret Type: Improper Authentication...

GHSA-MCWW-4HXQ-HFR3 LightRAG: Hardcoded JWT Signing Secret Allows Authentication Bypass

Subject: Security Vulnerability Report Hardcoded JWT Secret CVE-2026-30762 Hi HKUDS team, I'm writing to report a security vulnerability I discovered in LightRAG v1.4.10. This has been assigned CVE-2026-30762 by MITRE. Vulnerability: Hardcoded JWT signing secret Type: Improper Authentication...

Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries

Summary Aggregate functions min, max applied to fields with the conceal special type incorrectly return raw database values instead of the masked placeholder. When combined with groupBy, any authenticated user with read access to the affected collection can extract concealed field values, includi...

GHSA-38HG-WW64-RRWC Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries

Summary Aggregate functions min, max applied to fields with the conceal special type incorrectly return raw database values instead of the masked placeholder. When combined with groupBy, any authenticated user with read access to the affected collection can extract concealed field values, includi...

@altipla/directus-sdk-utils (0.7.2), @bicou/directus-extension-imagga (>=1.6.3, <=1.6.6) +5 more potentially affected by CVE-2026-35441 via directus (>=11.0.0, <=11.16.1)

directus NPM version =11.0.0, =1.6.3, =20.0.0-rc.0, =34.0.1 - @fahami/directus-pkce 1.0.0 - abcprotocol 0.0.1 Source cves: CVE-2026-35441 Source advisory: OSV:GHSA-PH52-67FQ-75WJ...

@altipla/directus-sdk-utils (0.7.2), @bicou/directus-extension-imagga (>=1.6.3, <=1.6.6) +5 more potentially affected by CVE-2026-39943 via directus (>=11.0.0, <=11.16.1)

directus NPM version =11.0.0, =1.6.3, =20.0.0-rc.0, =34.0.1 - @fahami/directus-pkce 1.0.0 - abcprotocol 0.0.1 Source cves: CVE-2026-39943 Source advisory: OSV:GHSA-MVV8-V4JJ-G47J...

@altipla/directus-sdk-utils (0.7.2), @bicou/directus-extension-imagga (>=1.6.3, <=1.6.6) +4 more potentially affected by CVE-2026-35409 via directus (>=11.0.0, <=11.15.4)

directus NPM version =11.0.0, =1.6.3, =20.0.0-rc.0, =33.3.1 - @fahami/directus-pkce 1.0.0 - abcprotocol 0.0.1 Source cves: CVE-2026-35409 Source advisory: OSV:GHSA-WV3H-5FX7-966H...

@altipla/directus-sdk-utils (0.7.2), @bicou/directus-extension-imagga (>=1.6.3, <=1.6.6) +4 more potentially affected by CVE-2026-35413 via directus (>=11.0.0, <=11.16.0)

directus NPM version =11.0.0, =1.6.3, =20.0.0-rc.0, =34.0.0 - @fahami/directus-pkce 1.0.0 - abcprotocol 0.0.1 Source cves: CVE-2026-35413 Source advisory: OSV:GHSA-WXWM-3FXV-MRVX...