CVE-2026-71312 vulnerabilities

Vulnerabilities for packages: rclone-fips, telegraf...

CVE-2026-59733 vulnerabilities

Vulnerabilities for packages: telegraf...

CVE-2026-8404 vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1, openstack-horizon-2026.1-fips...

GHSA-923M-GV2P-W5QP vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1, openstack-horizon-2026.1-fips...

GHSA-F23P-VX2J-J53R vulnerabilities

Vulnerabilities for packages: kibana, wazuh-dashboard, langfuse-fips, wazuh-dashboard-fips, langfuse...

CVE-2026-71848 vulnerabilities

Vulnerabilities for packages: kibana, wazuh-dashboard, langfuse-fips, wazuh-dashboard-fips, langfuse...

CVE-2026-71966

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated command injection vulnerability in the remote backup transfer feature that allows authenticated attackers to execute arbitrary OS commands by controlling a remote server's API response. Attackers can inject malicious commands...

CVE-2025-15681

TBEA TLogger V2.1.0.0B0.0.0.0 contains an authentication bypass in its web server. After a user has previously authenticated to the device, an unauthenticated attacker can directly access protected functionality through the /index.asp endpoint without providing valid credentials. This allows the...

CVE-2026-72902

Dokploy (PaaS) vulnerability CVE-2026-72902 affects version prior to 0.29.13. An authenticated user can run arbitrary commands on a local/SSH target because registry.ts interpolates the password field into an execAsyncRemote shell command instead of using safeDockerLoginCommand. This is fixed in ...

GHSA-P9J2-GV94-2WF4

creationtimestamp| type| source ---|---|--- 2026-08-10 19:39:37+00:00| seen| https://gist.github.com/klemmanton-lgtm/8b54bdd2fe9905dc89b9c8ccf42f5fc4 2026-08-10 19:39:38+00:00| seen| https://gist.github.com/klemmanton-lgtm/4a24aedae8017b5aebed0300d07c7ee9 2026-08-17 10:21:36+00:00| seen|...

CVE-2025-15681 Insufficient Webserver Authentication

TBEA TLogger V2.1.0.0B0.0.0.0 contains an authentication bypass in its web server. After a user has previously authenticated to the device, an unauthenticated attacker can directly access protected functionality through the /index.asp endpoint without providing valid credentials. This allows the...

CVE-2025-15681

CVE-2025-15681 affects TBEA TLogger V2.1.0.0B0.0.0.0. The web server contains an authentication bypass: after a user has authenticated, an unauthenticated attacker can access protected functionality via the /index.asp endpoint without valid credentials, potentially exposing or modifying device co...

CVE-2025-15681

TBEA TLogger V2.1.0.0B0.0.0.0 contains an authentication bypass in its web server. After a user has previously authenticated to the device, an unauthenticated attacker can directly access protected functionality through the /index.asp endpoint without providing valid credentials. This allows the...

EUVD-2025-210669

TBEA TLogger V2.1.0.0B0.0.0.0 contains an authentication bypass in its web server. After a user has previously authenticated to the device, an unauthenticated attacker can directly access protected functionality through the /index.asp endpoint without providing valid credentials. This allows the...

CVE-2026-72864

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the local branch of /docker-container-terminal in apps/dokploy/server/wss/docker-container-terminal.ts authenticates with validateRequest but does not authorize the attacker-controlled containerId against the caller's...

CVE-2026-72866

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the WebSocket handler in apps/dokploy/server/wss/terminal.ts validates a session but does not authorize access to the requested server. An authenticated user can connect to /terminal?serverId=local, select the special...

CVE-2026-71962

Flowise versions 2.2.4 through 3.1.4 contain a missing authorization vulnerability in the POST /api/v1/openai-assistants-file/download endpoint that allows unauthenticated attackers to access private files by exploiting the endpoint's inclusion in the global authentication whitelist, which bypass...

CVE-2026-72866

CVE-2026-72866 affects Dokploy PaaS. The WebSocket-based terminal handler (apps/dokploy/server/wss/terminal.ts) authenticates a session but does not authorize access to the requested server, allowing an authenticated user to connect to /terminal?serverId=local and gain an interactive terminal on ...

CVE-2026-72866 WebSocket Terminal Auth Bypass

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the WebSocket handler in apps/dokploy/server/wss/terminal.ts validates a session but does not authorize access to the requested server. An authenticated user can connect to /terminal?serverId=local, select the special...

CVE-2026-71962 Flowise 2.2.4 - 3.1.4 Missing Authorization via openai-assistants-file/download

Flowise versions 2.2.4 through 3.1.4 contain a missing authorization vulnerability in the POST /api/v1/openai-assistants-file/download endpoint that allows unauthenticated attackers to access private files by exploiting the endpoint's inclusion in the global authentication whitelist, which bypass...