36 matches found
EUVD-2026-107470
Apache Pulsar allows an administrator to require end-to-end message encryption for all topics in a namespace by setting the encryptionrequired namespace policy. When this policy is set, the broker rejects messages that are published without encryption. When the broker loads a persistent topic, it...
CLEANSTART-2026-UZ18323 in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it
CVE-2026-39833 affects multiple packages. The in-memory keyring returned by NewKeyring silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. See references for individual vulnerability details...
EUVD-2026-79140
On affected platforms running Arista EOS with dual switch cards and with ingress Security ACLs configured on Switched Virtual Interfaces SVI in shared mode, restarting of the secondary switchcard forwarding agent or insertion of secondary switchcard, can cause security ACLs on shared SVIs to stop...
CVE-2026-82209
When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a Set-Cookie header where the Domain attribute explicitly matches an origin host that is itself a public suffix e.g., Domain=co.uk set by co.uk. Instead of coercing it into a strict...
CVE-2026-17703
Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: High...
CVE-2026-4360
A flaw was found in the Python Tarfile.extract function. This vulnerability occurs when processing untrusted tar files containing hardlinks, as the filter parameter is not correctly enforced. An attacker could exploit this to write files with unintended user or group ownership, potentially leadin...
PT-2026-60092
Summary Kimai contains an authenticated improper authorization vulnerability in Team-related assignment APIs. A Teamlead who can edit their own team can use backend API endpoints to add users or activities that fall outside their intended visible or manageable scope, even when the frontend...
CVE-2026-14075
A policy bypass flaw was identified in the Chrome for iOS component of the Chromium browser. Specifically, insufficient policy enforcement allowed a remote attacker to bypass the no-referrer policy by using a crafted HTML page. The vulnerability affects versions prior to 150.0.7871.47 . Exploitat...
SUSE CVE-2026-11133
Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-40214
In OpenStack Cyborg before 16.0.1, the Accelerator Request ARQ API does not enforce project ownership at any layer. The projectid column in the database is never populated NULL for every ARQ, database queries have no project filtering, and policy checks are self-referential the authorizewsgi...
CVE-2026-49190
The system fails to evaluate instructional permissions over multiple internal operation codes opcodes, permitting unauthorized application installations or command executions...
CVE-2026-11206: Protection Mechanism Failure
Insufficient policy enforcement in ServiceWorker in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-10944: Protection Mechanism Failure
Insufficient policy enforcement in Autofill in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: High...
Google Go security vulnerabilities
Google Go is a static, strongly typed, compiled, concurrent programming language with garbage collection features from the American company Google. There is a security vulnerability in Google Go, which stems from keys that accept the ConfirmBeforeUse constraint but never enforce it, resulting in...
CVE-2026-9115: Protection Mechanism Failure
Insufficient policy enforcement in Service Worker in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: High...
WS-2019-0310
"in 'https-proxy-agent', before v2.2.3, there is a failure of TLS enforcement on the socket. Attacker may intercept unencrypted communications...
CVE-2026-8004: Protection Mechanism Failure
Insufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. Chromium security severity: Low...
CVE-2026-7937: Protection Mechanism Failure
Insufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. Chromium security severity: Medium...
PT-2026-46794
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 149.0.7827.53 Description Insufficient policy enforcement in Extensions allows an attacker to bypass the content security policy CSP—a security layer that helps detect and mitigate certain types of attacks,...
