Lucene search
+L

57621 matches found

Github Security Blog
Github Security Blog
added 5 days ago7 views

Wings exposes node configuration secrets through egg configuration-file templating

Impact Type: Exposure of sensitive information / insufficiently protected credentials leading to privilege escalation and full node compromise. Wings exposes its entire daemon configuration to the egg configuration-file templating engine. When Wings renders a server's configuration files, any...

9.9CVSS5.5AI score0.00274EPSS
SaveExploits0References4Affected Software1
EUVD
EUVD
added 5 days ago10 views

EUVD-2026-51568

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, config. placeholders in egg configuration-file templates allow a low-privileged user to read config.token, config.tokenid, and config.docker.registries from the full daemon...

9.9CVSS5.5AI score0.00274EPSS
SaveExploits0References3
OSV
OSV
added 5 days ago4 views

CVE-2026-52855 Wings exposes node configuration secrets through egg configuration-file templating

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, config. placeholders in egg configuration-file templates allow a low-privileged user to read config.token, config.tokenid, and config.docker.registries from the full daemon...

9.9CVSS5.5AI score
SaveExploits0References5
Cvelist
Cvelist
added 5 days ago36 views

CVE-2026-52855 Wings exposes node configuration secrets through egg configuration-file templating

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, config. placeholders in egg configuration-file templates allow a low-privileged user to read config.token, config.tokenid, and config.docker.registries from the full daemon...

9.9CVSS0.00274EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 5 days ago8 views

CVE-2026-52857

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, unbounded json, yaml, and xml configuration-file parsers in parser.go can process an oversized non-file parser configuration file and exhaust Wings process memory. This issue is...

5.5CVSS5.5AI score0.00113EPSS
SaveExploits0References4Affected Software1
Cvelist
Cvelist
added 5 days ago34 views

CVE-2026-52857 Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, unbounded json, yaml, and xml configuration-file parsers in parser.go can process an oversized non-file parser configuration file and exhaust Wings process memory. This issue is...

5.5CVSS0.00113EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment
added 5 days ago8 views

CVE-2026-52857 Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, unbounded json, yaml, and xml configuration-file parsers in parser.go can process an oversized non-file parser configuration file and exhaust Wings process memory. This issue is...

5.5CVSS5.5AI score0.00113EPSS
SaveExploits0References3
CVE
CVE
added 5 days ago17 views

CVE-2026-52857

CVE-2026-52857 affects Wings (Pterodactyl server control plane). Prior to 1.13.0, unbounded json, yaml, and xml configuration-file parsers in parser.go can process an oversized non-file parser configuration file and exhaust Wings’ memory. This is fixed in version 1.13.0. Impact is Availability (O...

5.5CVSS5.5AI score0.00113EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 5 days ago7 views

CVE-2026-56569

HCL iControl was affected by Sensitive Data Exposure vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or application hardening...

4CVSS5.5AI score0.00112EPSS
SaveExploits0References2
Cvelist
Cvelist
added 5 days ago38 views

CVE-2026-56569 HCL iControl is affected by multiple security vulnerabilities.

HCL iControl was affected by Sensitive Data Exposure vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or application hardening...

4CVSS0.00112EPSS
SaveExploits0References1
CVE
CVE
added 5 days ago11 views

CVE-2026-56569

Technical details of CVE-2026-56569 are not publicly available in the provided documents. Affected components, root cause, impact, and fixes are not disclosed here. Monitor the referenced sources for updates.

4CVSS5.5AI score0.00112EPSS
SaveExploits0References1
EUVD
EUVD
added 5 days ago10 views

EUVD-2026-51543

HCL iControl was affected by Sensitive Data Exposure vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or application hardening...

4CVSS5.5AI score0.00112EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 5 days ago8 views

CVE-2026-56567

HCL iControl v4.3.0 was affected by Security Misconfiguration vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or application hardening...

5.1CVSS5.5AI score0.00112EPSS
SaveExploits0References2
CVE
CVE
added 5 days ago10 views

CVE-2026-56567

Technical details about CVE-2026-56567 are not publicly available in the provided documents. Monitor for updates from the product/vendor and security advisories.

5.1CVSS5.5AI score0.00112EPSS
SaveExploits0References1
EUVD
EUVD
added 5 days ago10 views

EUVD-2026-51555

HCL iControl v4.3.0 was affected by Security Misconfiguration vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or application hardening...

5.1CVSS5.5AI score0.00112EPSS
SaveExploits0References1
EUVD
EUVD
added 5 days ago9 views

EUVD-2026-51554

The Zephyr Bluetooth GATT client CCC-write response handler gattwritecccrsp in subsys/bluetooth/host/gatt.c invoked the application's params-subscribe callback after it had already called params-notifyconn, params, NULL, 0. Per the public GATT API, a notify callback with NULL data is the document...

7.6CVSS5.6AI score0.00181EPSS
SaveExploits0References2
OSV
OSV
added 5 days ago5 views

CVE-2026-10685 Use-after-free of GATT subscribe params in Bluetooth host CCC-write response handler

The Zephyr Bluetooth GATT client CCC-write response handler gattwritecccrsp in subsys/bluetooth/host/gatt.c invoked the application's params-subscribe callback after it had already called params-notifyconn, params, NULL, 0. Per the public GATT API, a notify callback with NULL data is the document...

7.6CVSS5.6AI score
SaveExploits0References5
CVE
CVE
added 5 days ago13 views

CVE-2026-10685

CVE-2026-10685 : In Zephyr, the GATT client CCC-write response handler gatt_write_ccc_rsp() may call the application’s params->subscribe() after already invoking params->notify(conn, params, NULL, 0). A NULL data notify signals termination; calling subscribe() on the same bt_gatt_subscribe_...

7.6CVSS5.6AI score0.00181EPSS
SaveExploits0References2
NVD
NVD
added 5 days ago9 views

CVE-2026-11770

A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean...

7.5CVSS0.00506EPSS
SaveExploits0References3
Cvelist
Cvelist
added 5 days ago42 views

CVE-2026-11770 389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check

A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean...

7.5CVSS0.00506EPSS
SaveExploits0References3
Rows per page
Query Builder