211891 matches found
EUVD-2026-110063
OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to issue sync tokens via POST /api/sync/tokens when requireLogin is disabled. Attackers can use the issued token against GET /api/sync/bundle to retrieve decrypted provider...
SUSE CVE-2026-116193
Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests. Attackers can probe arbitrary paths and compare Allow header values to determine whether files or collections exist...
CVE-2026-116371
A weakness has been identified in Akuvox Akubela HyPanel PS51 51.130.40.26. The impacted element is an unknown function of the file /login. Executing a manipulation of the argument engrmode with the input admin can lead to improper authentication. The attack may be launched remotely. The vendor w...
AZL-112208 CVE-2026-115906 affecting package rust 1.75.0-31
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in src/aes.rs verifies its HMAC only when the attacker-controlled data counter reaches zero. If the underlying bounded reader reaches the real end of the archive while...
CVE-2026-102649
The Burrito Kubernetes operator (Terraform Automation Collaboration Software) is vulnerable to unauthorized actions prior to version 0.13.0 . When a TerraformRepository omits or leaves the webhookSecret empty, the POST /api/webhook endpoint accepts unsigned GitHub and GitLab events. An attacker w...
CVE-2026-102649 Burrito: Unauthenticated webhooks trigger unauthorized Terraform plans when webhookSecret is unset
Burrito is a Terraform Automation Collaboration Software TACoS Kubernetes operator. Prior to 0.13.0, POST /api/webhook accepts unsigned GitHub and GitLab events when a TerraformRepository's credentials omit webhookSecret or set it to an empty value, including credentials configured for git...
CVE-2026-115910 Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim
Python Social Auth is a social authentication and registration mechanism. Prior to 6.2.0, OpenIdConnectAuth in socialcore/backends/openidconnect.py uses getandstorenonce to place the OpenID Connect nonce in a shared OpenIdConnectAssociation table, and getnonce and validateclaims verify only that...
CVE-2026-115910
Python Social Auth is a social authentication and registration mechanism. Prior to 6.2.0, OpenIdConnectAuth in socialcore/backends/openidconnect.py uses getandstorenonce to place the OpenID Connect nonce in a shared OpenIdConnectAssociation table, and getnonce and validateclaims verify only that...
CVE-2026-115906
The zip library for Rust (versions 0.6.0 through 9.0.0 ) contains a vulnerability in the AES entry reader (src/aes.rs). The component fails to verify the HMAC authentication tag if the archive reaches the end of the stream while the data counter is still positive, or if an encrypted entry lacks a...
CVE-2026-115906 zip: AES Entry HMAC Authentication Bypass on Premature EOF
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in src/aes.rs verifies its HMAC only when the attacker-controlled data counter reaches zero. If the underlying bounded reader reaches the real end of the archive while...
CVE-2026-115906 zip: AES Entry HMAC Authentication Bypass on Premature EOF
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in src/aes.rs verifies its HMAC only when the attacker-controlled data counter reaches zero. If the underlying bounded reader reaches the real end of the archive while...
CVE-2026-115906 zip: AES Entry HMAC Authentication Bypass on Premature EOF
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in src/aes.rs verifies its HMAC only when the attacker-controlled data counter reaches zero. If the underlying bounded reader reaches the real end of the archive while...
CVE-2026-116371 Akuvox Akubela HyPanel PS51 login improper authentication
A weakness has been identified in Akuvox Akubela HyPanel PS51 51.130.40.26. The impacted element is an unknown function of the file /login. Executing a manipulation of the argument engrmode with the input admin can lead to improper authentication. The attack may be launched remotely. The vendor w...
CVE-2026-116371 Akuvox Akubela HyPanel PS51 login improper authentication
A weakness has been identified in Akuvox Akubela HyPanel PS51 51.130.40.26. The impacted element is an unknown function of the file /login. Executing a manipulation of the argument engrmode with the input admin can lead to improper authentication. The attack may be launched remotely. The vendor w...
CVE-2026-116371
A vulnerability exists in Akuvox Akubela HyPanel PS51 (version 51.130.40.26) involving improper authentication within an unknown function of the /login file. An attacker can remotely launch this attack by manipulating the engrmode argument with the input admin . No specific remediation or patch i...
EUVD-2026-109982
A weakness has been identified in Akuvox Akubela HyPanel PS51 51.130.40.26. The impacted element is an unknown function of the file /login. Executing a manipulation of the argument engrmode with the input admin can lead to improper authentication. The attack may be launched remotely. The vendor w...
CVE-2026-115678
Arm Keil MDK-Middleware 8.0.0-8.3.0 may allow pre-authentication out-of-bounds read in SNMP processing...
CVE-2026-115678
Arm Keil MDK-Middleware 8.0.0-8.3.0 may allow pre-authentication out-of-bounds read in SNMP processing...
CVE-2026-115678
Arm Keil MDK-Middleware versions 8.0.0-8.3.0 are susceptible to a pre-authentication out-of-bounds read vulnerability during SNMP processing . The issue is categorized under CWE-195 (Signed to Unsigned Conversion Error). While the vulnerability is accessible over the network without authenticatio...