31106 matches found
CVE-2026-94379
The login function in MISP's UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allowlist approach, checking only for specific HTTP methods POST and PUT before enforcing bruteforce protection, email one-time-passwo...
OPENSUSE-SU-2026:21899-1 Security update for alloy
This update for alloy fixes the following issues: - CVE-2026-1229: github.com/cloudflare/circl: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs bsc1265542. - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad...
SUSE-SU-2026:23853-1 Security update for alloy
This update for alloy fixes the following issues: - CVE-2026-1229: github.com/cloudflare/circl: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs bsc1265542. - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad...
node9-proxy v2.16.2
🛡️ node9 Access control for AI agents Your AI agents can reach Slack, GitHub, email, and your database. node9 decides what they may do with each one. Credential jail · secrets and PII · destructive git, SQL and shell held for review · MCP tool pinning · network egress allowlist · loop breaker · on...
Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in axios (CVE-2026-44486, CVE-2026-44487)
Summary Multiple proxy credential leakage vulnerabilities in the axios HTTP client library CVE-2026-44486, CVE-2026-44487 used by IBM InfoSphere Optim Archive Viewer have been addressed by upgrading the component to version 1.18.0. Vulnerability Details CVEID:CVE-2026-44486 DESCRIPTION: Axios is ...
CVE-2026-94215
A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm specified in the reque...
EUVD-2026-83841
A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm specified in the reque...
CVE-2026-94215 Keycloak-services: keycloak-services: cross-realm client read/write via request-level cache missing realm ownership check
A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm specified in the reque...
CVE-2026-94215
Keycloak's Admin REST API contains a cross-realm privilege escalation flaw. The API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying realm ownership , allowing a limited-privilege administrator to read or modify client configurations in the master...
CVE-2026-94215
A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm specified in the reque...
Multiple vulnerabilities impacts AIX due to cURL libcurl
IBM SECURITY ADVISORY First Issued: Mon Sep 21 04:38:42 CDT 2026 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/curladvisory12.asc Security Bulletin: Multiple vulnerabilities impacts AIX due to cURL libcurl...
MAL-2026-16326 Malicious code in byted-commerce-materials (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f777e32b4a6cbb7f91f7fcac050a02a73e356df1c87e7dcd985ea9172a3993da package.json declares both preinstall and postinstall running node callback.js, so the payload fires automatically on npm install. callback.js collec...
Malicious code in @siriusbeyond/ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d81713c34940a8d3511a53c6cb8001481734bc2493be23d0f6ddb1dd561fa72 On npm install, both preinstall and postinstall lifecycle hooks execute callback.js, which collects installer host identity hostname, username,...
Malicious code in @siriusbeyond/utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 330b388e1f9ee72c0c2a94cca9e4cc7ff3b525a3f673b324b093286329f60689 Package @siriusbeyond/[email protected] declares both preinstall and postinstall scripts that execute callback.js on npm install. callback.js collects hos...
MAL-2026-16322 Malicious code in @siriusbeyond/utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 330b388e1f9ee72c0c2a94cca9e4cc7ff3b525a3f673b324b093286329f60689 Package @siriusbeyond/[email protected] declares both preinstall and postinstall scripts that execute callback.js on npm install. callback.js collects hos...
Malicious code in @dbbhk/ui-components (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 478839dda68d2c5eefa1a55557602d4b12396c988211b28d785af531d0b19d07 @dbbhk/[email protected] declares both preinstall and postinstall hooks in package.json that execute node callback.js, so the payload runs...
MAL-2026-16319 Malicious code in @dbbhk/ui-components (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 478839dda68d2c5eefa1a55557602d4b12396c988211b28d785af531d0b19d07 @dbbhk/[email protected] declares both preinstall and postinstall hooks in package.json that execute node callback.js, so the payload runs...
Malicious code in @nimbusedge2/authxsas (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0146259024cc8ef3a174ff98571fe4af975b3eecf9184a0a5339d42808243d10 The package's package.json declares a preinstall script that fires unconditionally on npm install. The script uses curl to query the cloud instance...
CVE-2026-79317
A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only checks that a user object can be retrieved from the cookie without re-validating against the database or any session version. When an administrator changes the...
PT-2026-96146
Name of the Vulnerable Software and Affected Versions Feast versions prior to 0.65.0 Description The .github/workflows/pr integration tests.yml workflow uses pull request target with the synchronize event and preserves ok-to-test, approved, or lgtm labels across newly pushed commits. This allows ...