343197 matches found
CVE-2026-2581
This is an uncontrolled resource consumption vulnerability CWE-400 that can lead to Denial of Service DoS. In vulnerable Undici versions, when interceptors.deduplicate is enabled, response data for deduplicated requests could be accumulated in memory for downstream handlers. An attacker-controlle...
OpenClaw: /api/channels gateway-auth boundary bypass via path canonicalization mismatch
Summary Gateway auth for plugin channel endpoints can be bypassed when path canonicalization differs between the gateway guard and plugin handler routing. Details On affected versions, server-http only applies gateway auth when raw requestPath matches exactly: - /api/channels - /api/channels/ If ...
PT-2026-24679
CVE-2025-70027 An issue pertaining to CWE-918: Server-Side Request Forgery was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4. This allows attackers to obtain sensitive informati… https://t.co/0CdAjHLKpo...
CVE-2026-26123
Cwe is not in rca categories in Microsoft Authenticator allows an unauthorized attacker to disclose information locally...
CVE-2026-26123
Cwe is not in rca categories in Microsoft Authenticator allows an unauthorized attacker to disclose information locally...
EUVD-2025-208475
An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in benkeen generatedata 4.0.14...
CVE-2025-70042
An issue pertaining to CWE-918: Server-Side Request Forgery was discovered in oslabs-beta ThermaKube master...
XSS in LDAP server option
...
Authentication Lockout Bypass via Race Condition
...
shell command limitation bypass by SSH local config overriding
...
Buffer overflow via fgtupdates service
...
CVE-2025-70025
CVE-2025-70025 concerns benkeen generatedata 4.0.14, with a vulnerability described as CWE-79: Improper Neutralization of Input During Web Page Generation. The connected sources consistently identify benkeen generatedata 4.0.14 as affected. CVSSv3.1 base score is 6.1 (MEDIUM) with network access,...
Unauthorized Session Creation via Reserved Framework Path Access
An authentication bypass vulnerability exists in Vaadin applications using Spring Security due to inconsistent path pattern matching of reserved framework paths. Accessing the /VAADIN endpoint without a trailing slash bypasses security filters, allowing unauthenticated users to trigger framework...
EUVD-2025-208455
An issue pertaining to CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4...
EUVD-2025-208451
An issue pertaining to CWE-601: URL Redirection to Untrusted Site was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4...
CVE-2025-70042
An issue pertaining to CWE-918: Server-Side Request Forgery was discovered in oslabs-beta ThermaKube master...
CVE-2025-70039
CVE-2025-70039 affects linagora Twake 2023.Q1.1223 with a CWE-78 OS command injection vulnerability. Base CVSS 3.1: 9.8 (_network, no auth, no user interaction, impact high for confidentiality, integrity, and availability). Root cause: improper neutralization of special elements used in an OS com...
CVE-2025-70039
An issue pertaining to CWE-78: Improper Neutralization of Special Elements used in an OS Command was discovered in linagora Twake v2023.Q1.1223...