CVE-2026-54246

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.13, the routesrv component serves cluster-wide control-plane data without application-layer authentication through /routes, /routes/zone, /swarm/redis/shards, and /swarm/valkey/shards. The handlers registered in...

EUVD-2026-78061

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.13, the routesrv component serves cluster-wide control-plane data without application-layer authentication through /routes, /routes/zone, /swarm/redis/shards, and /swarm/valkey/shards. The handlers registered in...

CVE-2026-54246

CVE-2026-54246 affects the routesrv component of Skipper (Zalando's HTTP router and reverse proxy). Prior to version 0.27.13 , routesrv serves cluster-wide control-plane data—Ingress/RouteGroup backend URLs, filter-chain and OAuth/OIDC path details, and Redis/Valkey shard addresses—over plain HTT...

CVE-2026-54246: Missing Authentication for Critical Function

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.13, the routesrv component serves cluster-wide control-plane data without application-layer authentication through /routes, /routes/zone, /swarm/redis/shards, and /swarm/valkey/shards. The handlers registered in...

SAP NetWeaver AS ABAP Missing Authorization Check (3772838)

The version of SAP NetWeaver AS ABAP detected on the remote host is affected by a missing authorization check vulnerability as referenced in SAP Security Note 3772838: - Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker...

PYSEC-2026-3955

A Server-Side Request Forgery SSRF vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The nltk.pathsec.validatenetworkurl function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space 100.64.0.0/1...

DEBIAN-CVE-2026-12372

A Server-Side Request Forgery SSRF vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The nltk.pathsec.validatenetworkurl function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space 100.64.0.0/1...

CVE-2026-12372 Server-Side Request Forgery (SSRF) in nltk/nltk

A Server-Side Request Forgery SSRF vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The nltk.pathsec.validatenetworkurl function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space 100.64.0.0/1...

CVE-2026-12372: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSRF vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The nltk.pathsec.validatenetworkurl function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space 100.64.0.0/1...

Security Bulletin: IBM WebSphere Automation is vulnerable to CVE-2026-35554 which affects the kakfa client library

Summary IBM WebSphere Automation is vulnerable to CVE-2026-35554, which causes a race condition in the Apache Kafka Java producer client's buffer pool management which can cause messages to be silently delivered to incorrect topics. Vulnerability Details CVEID:CVE-2026-35554 DESCRIPTION: A race...

CVE-2026-2401: Insertion of Sensitive Information into Log File

CWE-532 Insertion of Sensitive Information into Log File vulnerability exists that could cause confidential information to be exposed when a Web Admin user executes a malicious file provided by an attacker...

The vulnerability of the goform/SetIpMacBind file in the Tenda TX3 router microprogramming software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the goform/SetIpMacBind function in the Tenda TX3 router microprogramming system lies in the fact that the operation’s output goes beyond the buffer in memory. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrity, and accessibili...

The vulnerability of the Secure Encrypted Virtualization (SEV) technology of AMD’s microprogramming processor allows attackers to compromise the confidentiality of protected information.

The vulnerability of the Secure Encrypted Virtualization SEV technology of AMD microprocessors is related to deficiencies in access control. Exploiting this vulnerability could allow attackers to compromise the confidentiality of the protected information...

The vulnerability of the hash_accept() function in the crypto/algif_hash.c component of the Linux kernel allows a hacker to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the hashaccept function in the crypto/algifhash.c component of the Linux kernel is related to the repeated release of memory. Exploiting this vulnerability could allow an attacker to gain access to confidential data, compromise its integrity, and cause service failures...

The vulnerability of the cdrom_ioctl_timed_media_change() function in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the cdromioctltimedmediachange function in the Linux operating system is related to integer overflow. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

CVE-2024-45450: Exposure of Sensitive Information to an Unauthorized Actor

Permission control vulnerability in the software update module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

Huawei HarmonyOS 安全漏洞

Huawei HarmonyOS is a distributed operating system developed independently by Huawei Technologies Co. Huawei EMUI is Huawei's emotional operating system based on Android. A data validation error vulnerability exists in Huawei HarmonyOS/EMUI, which originates from a data validation error...

CVE-2023-50781: Observable Discrepancy

A flaw was found in m2crypto. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data...

Security Bulletin: TXSeries for Multiplatforms is vulnerable to several no confidentiality exposures due to IBM SDK, Java Technology Edition

Summary IBM SDK, Java Technology Edition is used by TXSeries for Multiplatforms to run WebSphere Liberty, Fix Installer and Java based CICS applications. The fix removes the no confidentiality exposure vulnerabilities CVE-2022-21496, CVE-2022-21434 and CVE-2022-21443 from IBM SDK, JTE...

CVE-2021-3503: Exposure of Sensitive Information to an Unauthorized Actor

A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data. The highest threat from this vulnerability is to the confidentiality...