Lucene search
+L

3820 matches found

IBM Security Bulletins
IBM Security Bulletins
•added 2026/08/13 1:26 p.m.•10 views

Security Bulletin: IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution

Summary IBM Documentation Offline is a desktop application that bundles an Electron-based viewer and an embedded Node.js web server to serve product documentation locally on the user's workstation. Multiple vulnerabilities have been identified in the embedded server component spanning three...

9.8CVSS6.1AI score0.00916EPSS
SaveExploits0Affected Software1
Positive Technologies
Positive Technologies
•added 2026/08/13 12:00 a.m.•13 views

PT-2026-71807

IBM Documentation Offline 1.0.0 through 1.4.1 IBM Documentation could allow a remote attacker to obtain sensitive information due to a security misconfiguration where the documentation server binds to an unrestricted IP address...

4.3CVSS5.3AI score0.00463EPSS
SaveExploits0References2
OSV
OSV
•added 2026/08/12 8:23 p.m.•42 views

CVE-2026-73419 NextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them

NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to the provider that created them. On callback, a check value...

6.8CVSS5.3AI score
SaveExploits0References9
Cvelist
Cvelist
•added 2026/08/12 8:23 p.m.•32 views

CVE-2026-73419 NextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them

NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to the provider that created them. On callback, a check value...

6.8CVSS0.00249EPSS
SaveExploits0References7
CVE
CVE
•added 2026/08/12 8:23 p.m.•80 views

CVE-2026-73419

NextAuth.js/NMD vulnerability CVE-2026-73419 affects Auth.js OAuth/OIDC flow cookies. Prior to Auth.js @auth/core 0.41.3 and NextAuth.js 4.24.15 or 5.0.0-beta.32, state, nonce, and PKCE verifier were stored in global cookies not bound to the originating provider. On callback, a value from one pro...

6.8CVSS5.2AI score0.00249EPSS
SaveExploits0References7
NVD
NVD
•added 2026/08/12 7:17 p.m.•17 views

CVE-2026-18677

In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authenticator in kuma-cp validates that label only when the dataplane token is bound to a workload. Workload binding is optional, so a dataplane...

6CVSS0.00427EPSS
SaveExploits0References5
Vulnrichment
Vulnrichment
•added 2026/08/12 6:47 p.m.•8 views

CVE-2026-18677 Kong Mesh: a dataplane token without a workload binding can claim any workload's SPIFFE identity

In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authenticator in kuma-cp validates that label only when the dataplane token is bound to a workload. Workload binding is optional, so a dataplane...

6CVSS5.3AI score0.00427EPSS
SaveExploits0References5
OSV
OSV
•added 2026/08/12 6:47 p.m.•19 views

CVE-2026-18677 Kong Mesh: a dataplane token without a workload binding can claim any workload's SPIFFE identity

In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authenticator in kuma-cp validates that label only when the dataplane token is bound to a workload. Workload binding is optional, so a dataplane...

6CVSS5.3AI score
SaveExploits0References7
Positive Technologies
Positive Technologies
•added 2026/08/12 12:00 a.m.•10 views

PT-2026-71254

Budibase is an open-source low-code platform. Prior to 3.40.0, POST /api/v2/email on account.budibase.app accepted a client-controlled accountId without binding it to the authenticated session, while checking only currentEmail. An authenticated attacker who obtains a victim account identifier can...

8.2CVSS5.4AI score0.00308EPSS
SaveExploits0References3
Cvelist
Cvelist
•added 2026/08/11 8:37 p.m.•37 views

CVE-2026-48765 TypeBot vulnerable to cross-workspace OAuth credential takeover in updateOAuthCredentials via missing object binding

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege read collaborator to extract a workspace OAuth credentialsId from a readable bot configuration and then overwrite that credential through handleUpdateOAuthCredentials by supplying an attacker-controlled writable...

9.9CVSS0.00456EPSS
SaveExploits0References4
CVE
CVE
•added 2026/08/11 8:37 p.m.•40 views

CVE-2026-48765

CVE-2026-48765 affects TypeBot (a chatbot builder tool). Versions prior to 3.17.0 allow a low-privilege read collaborator to extract a workspace OAuth credentialsId from a readable bot configuration and then overwrite that credential via handleUpdateOAuthCredentials using an attacker-controlled w...

9.9CVSS5.3AI score0.00456EPSS
SaveExploits0References4
OSV
OSV
•added 2026/08/11 8:37 p.m.•23 views

CVE-2026-48765 TypeBot vulnerable to cross-workspace OAuth credential takeover in updateOAuthCredentials via missing object binding

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege read collaborator to extract a workspace OAuth credentialsId from a readable bot configuration and then overwrite that credential through handleUpdateOAuthCredentials by supplying an attacker-controlled writable...

9.9CVSS5.3AI score
SaveExploits0References6
Vulnrichment
Vulnrichment
•added 2026/08/11 8:37 p.m.•11 views

CVE-2026-48765 TypeBot vulnerable to cross-workspace OAuth credential takeover in updateOAuthCredentials via missing object binding

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege read collaborator to extract a workspace OAuth credentialsId from a readable bot configuration and then overwrite that credential through handleUpdateOAuthCredentials by supplying an attacker-controlled writable...

9.9CVSS5.3AI score0.00456EPSS
SaveExploits0References4
NVD
NVD
•added 2026/08/11 1:19 p.m.•18 views

CVE-2026-72750

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the Snowflake node's Execute Query operation, which interpolates expression values directly into the SQL string. When a workflow author embeds untrusted, externally-controlled expression data directly in a raw SQL...

8.8CVSS0.00471EPSS
SaveExploits0References2
CVE
CVE
•added 2026/08/11 12:17 p.m.•67 views

CVE-2026-72750

n8n versions before 1.123.67, 2.31.5, and 2.32.1 are affected by a SQL injection vulnerability in the Snowflake node's Execute Query operation. The root cause is that expression values are interpolated directly into the SQL string without parameterization, so when a workflow author embeds untrust...

8.8CVSS5.6AI score0.00471EPSS
SaveExploits0References2Affected Software1
NVD
NVD
•added 2026/08/11 9:17 a.m.•14 views

CVE-2026-73159

Affected versions of cti-transmute allow a tag's icon value to be stored and later interpolated into HTML through Vue's v-html. The helper mapIcon previously constructed an HTML string directly from the icon value: Because the icon is user-supplied, a crafted value could break out of the intended...

5.1CVSS0.00396EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
•added 2026/08/11 12:00 a.m.•11 views

PT-2026-70047

Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description SAP Approuter does not enforce cross-site request forgery CSRF protection on the authentication flow by default. CSRF is a type of attack that tricks a victim into submitting a maliciou...

4.3CVSS5.1AI score0.00165EPSS
SaveExploits0References5
Cvelist
Cvelist
•added 2026/08/11 12:00 a.m.•41 views

CVE-2026-51584

An issue in usememos v0.27.1 allows a remote attacker to achieve account takeover via the ssoCredentials branch of the SignIn handler in server/router/api/v1/authservice.go, because SSO identity is matched only on an attacker-controllable identifier without binding to the IdP's stable subject cla...

0.0061EPSS
SaveExploits0References2
SUSE Linux
SUSE Linux
•added 2026/08/10 6:04 p.m.•16 views

Security update for bouncycastle

This update for bouncycastle fixes the following issues: CVE-2026-8763: Name Constraints bypass via trailing dot in rfc822Name and URI bsc1272700. CVE-2026-12185: BKS/UBER keystore allocates from untrusted lengths before integrity check bsc1272701. CVE-2026-12802: CMS AuthEnvelopedData fails to...

9.3CVSS5.9AI score0.00616EPSS
SaveExploits0References128
NVD
NVD
•added 2026/08/10 1:20 p.m.•18 views

CVE-2026-68338

In the Linux kernel, the following vulnerability has been resolved: net/packet: avoid fanout hook re-registration after unregister packetsetring temporarily detaches a socket from packet delivery while reconfiguring its ring. It records the previous running state, clears po-num, unregisters the...

7.8CVSS0.00176EPSS
SaveExploits0References8
Rows per page
Query Builder