1032 matches found
EUVD-2026-104987
In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substitution are rendered by an uncapped Liquid engine before authentication and RBAC. The bearer check does not reject a missing or invalid token, and the auth rate limit applies...
CVE-2026-113619 Eclipse ioFog renders request templates before authentication
In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substitution are rendered by an uncapped Liquid engine before authentication and RBAC. The bearer check does not reject a missing or invalid token, and the auth rate limit applies...
MAS-Guard: Unified Guardrails from Individual Agents to Multi-Agent LLM Systems
Agentic AI extends large language models LLMs from generating responses to planning and executing complex workflows, substantially expanding their utility while exposing applications to unsafe actions, information leakage, and adversarial manipulation. Multi-agent systems further expand these...
PT-2026-118359
In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substitution are rendered by an uncapped Liquid engine before authentication and RBAC. The bearer check does not reject a missing or invalid token, and the auth rate limit applies...
GHSA-VX2M-GPQ4-8J5Q LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files
Summary loopx serve-status sends Access-Control-Allow-Origin: on every response, including its unauthenticated GET routes. Because the endpoint is unauthenticated and bound to a fixed, well-known loopback port, any website the operator visits can read LoopX control-plane state and the contents of...
LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files
Summary loopx serve-status sends Access-Control-Allow-Origin: on every response, including its unauthenticated GET routes. Because the endpoint is unauthenticated and bound to a fixed, well-known loopback port, any website the operator visits can read LoopX control-plane state and the contents of...
Eclipse ioFog resource management error vulnerability
Versions 3.8.0 through 3.9.1 of Eclipse ioFog contain a resource management error vulnerability. This vulnerability arises because, prior to authentication and RBAC, POST, PUT, and PATCH request bodies on routes that enable template substitution are rendered by an unrestricted Liquid engine...
WSO2 API Control Plane session mechanism vulnerability
WSO2 API Control Plane versions prior to 4.5.0 and 4.6.0 and 4.6.0 and 4.6.0.13 contained a session mechanism vulnerability. This vulnerability stemmed from the use of the session binding token feature and token binding verification, but without enabling the “Revoke tokens upon user logout” optio...
WSO2 API Manager Cross-Site Scripting Vulnerability
WSO2 API Manager versions prior to 3.2.0.4, 3.2.1.3 to 3.2.1.53, 4.1.0.214 to 4.1.0.215, 4.2.0.153 to 4.2.0.153, 4.3.0.66 to 4.3.0.66, 4.4.0.29 to 4.4.0.29, and 4.5.0.11 to 4.5.0.11; WSO2 Universal Gateway versions prior to 4.5.0.11; WSO2 Traffic Manager versions prior to 4.5.0.11; WSO2 API Contr...
WSO2 Universal Gateway encryption vulnerabilities
WSO2 Universal Gateway versions from 4.5.0 through 4.5.0.46 and from 4.6.0 through 4.6.0.14, WSO2 Traffic Manager versions from 4.5.0 through 4.5.0.45 and from 4.6.0 through 4.6.0.14, WSO2 API Control Plane versions from 4.5.0 through 4.5.0.47 and from 4.6.0 through 4.6.0.15, WSO2 API Manager...
WSO2 API Manager authorization issue vulnerability
WSO2 API Manager versions prior to 3.2.0.4.34, 3.2.1.54, 4.1.0.218, 4.2.0.156, 4.3.0.67, 4.4.0.30, and 4.5.0.14; WSO2 Universal Gateway versions prior to 4.5.0.14; WSO2 API Control Plane versions prior to 4.5.0.15; and Forgerock Key Manager Component versions prior to 1.0.0.4, 1.1.0.2, and 1.1.5....
CVE-2026-102748
Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. The /removeNode route accepts attacker-controlled id and group values and passes them to...
CVE-2026-102748 Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service
Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. The /removeNode route accepts attacker-controlled id and group values and passes them to...
CVE-2026-102748
Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. The /removeNode route accepts attacker-controlled id and group values and passes them to...
CVE-2026-102050
A Stack-based Buffer Overflow vulnerability in the l2cpd daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service in Layer 2 control-plane processing via LLDP packets received on an interface configured for LLDP. Repeated...
CVE-2026-102051
An Improper Release of Memory Before Removing Last Reference vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved platforms allows an adjacent unauthenticated attacker to cause l2cpd memory exhaustion and Layer 2 control-plane disruption via LLDP traffic when fast...
CVE-2026-102051 Junos OS and Junos OS Evolved: An attacker causes l2cpd memory exhaustion when LLDP fast receive processing is enabled
An Improper Release of Memory Before Removing Last Reference vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved platforms allows an adjacent unauthenticated attacker to cause l2cpd memory exhaustion and Layer 2 control-plane disruption via LLDP traffic when fast...
CVE-2026-102051
The l2cpd process in Juniper Networks Junos OS and Junos OS Evolved platforms is vulnerable to an Improper Release of Memory Before Removing Last Reference (CWE-401). An adjacent unauthenticated attacker can trigger l2cpd memory exhaustion and Layer 2 control-plane disruption by sending LLDP traf...
EUVD-2026-101375
An Improper Release of Memory Before Removing Last Reference vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved platforms allows an adjacent unauthenticated attacker to cause l2cpd memory exhaustion and Layer 2 control-plane disruption via LLDP traffic when fast...
EUVD-2026-101374
A Stack-based Buffer Overflow vulnerability in the l2cpd daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service in Layer 2 control-plane processing via LLDP packets received on an interface configured for LLDP. Repeated...