421 matches found
CVE-2026-80312
The camel-oauth component in Apache Camel contains an Improper Authentication vulnerability (CWE-287) where route-guard processors (e.g., OAuthBearerTokenProcessor) fail to stop the exchange when authentication cannot be completed. Instead of terminating the route, the processors fall through, al...
PT-2026-117338
Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.11.0 through 4.18.4 Apache Camel versions 4.19.0 through 4.22.0 Description An improper authentication issue exists in the Apache Camel OAuth component. The camel-oauth processors designed to guard routes fail to stop t...
CVE-2026-80312: Improper Authentication
Improper Authentication vulnerability in Apache Camel OAuth component. This issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-oauth processors that guard a route did not stop the exchange when authentication could not be completed. Where a failure to...
AlmaLinux 9.2 [TuxCare] Security Update: libipa_hbac / libipa_hbac-devel / libsss_autofs / libsss_certmap / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792405584)
The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792405584 advisory. - A flaw was found in SSSD. A local user can trigger a Denial of Service DoS by exploiting a race condition in the autofs responder...
Exploit for CVE-2026-80312
CVE-2026-80312 — camel-oauth: fail-open authentication guard...
CVE-2026-77474 dcg: Exponential-time command-substitution preprocessing lets a crafted command hang dcg and bypass the guard via hook-timeout fail-open
destructivecommandguard dcg is a command-line safety tool that blocks destructive shell commands before AI coding agents run them. Prior to 0.6.6, nested or unclosed substitutions are recursively rescanned after an inner scan returns unterminated, producing exponential-time work. The affected...
CVE-2026-77474
The destructive_command_guard (dcg) tool (prior to version 0.6.6 ) is vulnerable to an exponential-time command-substitution preprocessing flaw. The issue occurs because nested or unclosed substitutions (e.g., $( or $(() cause the scanner to recursively rescans the remaining command suffix. This ...
CVE-2026-77474 dcg: Exponential-time command-substitution preprocessing lets a crafted command hang dcg and bypass the guard via hook-timeout fail-open
destructivecommandguard dcg is a command-line safety tool that blocks destructive shell commands before AI coding agents run them. Prior to 0.6.6, nested or unclosed substitutions are recursively rescanned after an inner scan returns unterminated, producing exponential-time work. The affected...
CVE-2026-77474 dcg: Exponential-time command-substitution preprocessing lets a crafted command hang dcg and bypass the guard via hook-timeout fail-open
destructivecommandguard dcg is a command-line safety tool that blocks destructive shell commands before AI coding agents run them. Prior to 0.6.6, nested or unclosed substitutions are recursively rescanned after an inner scan returns unterminated, producing exponential-time work. The affected...
CVE-2026-107910 Authentication bypass in FalkorDB Bolt endpoint via fail-open AUTH probe error handling
An improper authentication vulnerability in the isauthenticated function src/bolt/boltapi.c in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to execute graph queries without credentials through the Bolt endpoint. The function decides whether a password is required by issuing an...
CVE-2026-107735 SumatraPDF: `sumatrapdfrestrict.ini` never revokes any permission (fail-open policy initialization)
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, InitializePolicies starts the sumatrapdfrestrict.ini path with gPolicyRestrictions set to Perm::All and only ORs permission bits, so the INI file never revokes permissions. Deploying SumatraPDF with this INI file, including a...
CVE-2026-101998 Fail-open response masking in Docker Sandboxes can expose proxy-managed credentials
Docker Sandboxes could fail open while masking credentials in protected proxy responses. When a response-body read returned data together with an error, affected handlers could forward unmasked bytes. Code inside an authorized sandbox could use this to recover host-managed OAuth access and refres...
UBUNTU-CVE-2026-103932
GHSA-5m93-4h75-3p2w: @rxGlobal PCRE2 error handling: match-limit fail-open and invalid-pattern crash...
CVE-2026-103932
GHSA-5m93-4h75-3p2w: @rxGlobal PCRE2 error handling: match-limit fail-open and invalid-pattern crash...
EUVD-2026-78300
proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet...
PT-2026-115363
GHSA-5m93-4h75-3p2w: @rxGlobal PCRE2 error handling: match-limit fail-open and invalid-pattern crash...
CVE-2026-105127
LaraDashboard 1.4.2 before 1.4.8 applies advanced email validation to unauthenticated forgot-password and reset-password requests, triggering DNS lookups and paid AbstractAPI verification calls. Unauthenticated attackers can submit arbitrary addresses to exhaust the verification quota, making...
CVE-2026-104002
A fail-open error handling issue within the data masking utility of Powertools for AWS Lambda Python might allow actors to read sensitive field values that the application intended to mask. To remediate this issue, users should upgrade to version 3.35.0...
CVE-2026-104002
A fail-open error handling issue within the data masking utility of Powertools for AWS Lambda Python might allow actors to read sensitive field values that the application intended to mask. To remediate this issue, users should upgrade to version 3.35.0...
CVE-2026-104002 Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)
A fail-open error handling issue within the data masking utility of Powertools for AWS Lambda Python might allow actors to read sensitive field values that the application intended to mask. To remediate this issue, users should upgrade to version 3.35.0...