enforcement-coverage

تغطية الإنفاذ تكتشف مسارات API التي تحمل تحكمًا في التفويض أضعف من مساراتها الشقيقة. عثرت على CVE-2026-45316 في Open WebUI من الكود المصدري وحده، دون أي معرفة مسبقة بنشرة أمنية: root@kitploit: MISMATCH POST /notes/id/pin notes.py:pinnotebyid 3/3 comparable write operations on note require...

cygor

Cygor Panoramica Generale Cygor è un framework modulare di scoperta degli asset che riunisce scansione, parsing ed enumerazione dei servizi in un unico flusso di lavoro. Sostituisce l'insieme eterogeneo di strumenti separati con un processo automatizzato che gestisce senza soluzione di continuità...

rugmuncher-backend

RMI Backend Repo: git.rugmunch.io/RugMunchMedia/rmi-backend Deploy: /root/backend/ su Talos Container: rmi-backend Health: http://127.0.0.1:8000/health attualmente non sano — l'host Redis non risolve Cos'è Backend FastAPI per la piattaforma RMI. Fornisce scansioni del rischio dei token, analisi...

FencePost

FencePost Dashboard multi-host per il firewall UFW. Si connette a host Linux tramite SSH, analizza le regole del firewall e le porte in ascolto, spiega tutto in italiano semplice e segnala le lacune di sicurezza. Caratteristiche Panoramica multi-host — visualizza a colpo d'occhio lo stato UFW, le...

briefr

BRIEFR Intelligence CVE e detection engineering self-hosted Cos'è BRIEFR? · Schermate · Per iniziare · Documentazione · Licenza Cos'è BRIEFR? BRIEFR è una piattaforma self-hosted di intelligence sulle CVE. Recupera i dati sulle vulnerabilità da fonti pubbliche e community — NVD, CISA KEV, EPSS,...

Exploit for CVE-2026-73678

CVE-2026-73678 — Unauthenticated RCE in MindsDB Minds Platform...

CVE-2026-68968 Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

VulnCheck KEV: CVE-2026-2652

A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled --app-name basic-auth and served via uvicorn ASGI. The FastAPI permission middleware only enforces authentication on /gateway/...

CVE-2026-24229

NVIDIA TensorRT-LLM for Linux contains a vulnerability in the disaggregated orchestrator component, where an attacker could read, write, or delete internal cluster state by sending requests to the FastAPI server. A successful exploit of this vulnerability might lead to information disclosure, dat...

CVE-2026-24229

NVIDIA TensorRT-LLM for Linux contains a vulnerability in the disaggregated orchestrator component, where an attacker could read, write, or delete internal cluster state by sending requests to the FastAPI server. A successful exploit of this vulnerability might lead to information disclosure, dat...

CVE-2026-24229

CVE-2026-24229 affects NVIDIA TensorRT-LLM for Linux, specifically the disaggregated orchestrator. The issue allows an attacker to read, write, or delete internal cluster state by sending requests to the FastAPI server, potentially enabling information disclosure, data tampering, and denial of se...

PYSEC-2026-1362 FastAPI SSP is vulnerable to Cross-site Request Forgery (CSRF) through improper OAuth parameter validation

Versions of the package fastapi-sso before 0.19.0 are vulnerable to Cross-site Request Forgery CSRF due to the improper validation of the OAuth state parameter during the authentication callback. While the getloginurl method allows for state generation, it does not persist the state or bind it to...

PYSEC-2026-1363 FastAPI Users Vulnerable to 1-click Account Takeover in Apps Using FastAPI SSO

Description The OAuth login state tokens are completely stateless and carry no per-request entropy or any data that could link them to the session that initiated the OAuth flow. generatestatetoken is always called with an empty statedata dict, so the resulting JWT only contains the fixed audience...

PYSEC-2026-1360 FastAPI Guard has a regex bypass

Summary The regular expression patched to mitigate the ReDoS vulnerability by limiting the length of string fails to catch inputs that exceed this limit. Details In version 3.0.1, you can find a commit like the one in the link below, which was made to prevent ReDoS...

PYSEC-2026-1359 fastapi-guard is vulnerable to ReDoS through inefficient regex

Summary fastapi-guard detects penetration attempts by using regex patterns to scan incoming requests. However, some of the regex patterns used in detection are extremely inefficient and can cause polynomial complexity backtracks when handling specially crafted inputs. It is not as severe as...

PYSEC-2026-1943 Starlette Denial of service (DoS) via multipart/form-data

Summary Starlette treats multipart/form-data parts without a filename as text form fields and buffers those in byte strings with no size limit. This allows an attacker to upload arbitrary large form fields and cause Starlette to both slow down significantly due to excessive memory allocations and...

PYSEC-2026-1357 FastAPI Admin Cross-site Scripting vulnerability in the Config-Create function

A cross-site scripting XSS vulnerability in the Config-Create function of fastapi-admin pro v0.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Name parameter...

PYSEC-2026-1356 FastAPI Admin cross-site scripting (XSS) vulnerability in the Create Product function

A cross-site scripting XSS vulnerability in the Create Product function of fastapi-admin pro v0.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Name parameter...

PYSEC-2026-419 mlflow: FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization

In mlflow/mlflow, the FastAPI job endpoints under /ajax-api/3.0/jobs/ are not protected by authentication or authorization when the basic-auth app is enabled. This vulnerability affects the latest version of the repository. If job execution is enabled MLFLOWSERVERENABLEJOBEXECUTION=true and any j...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: python-sentry-sdk: python3-sentry-sdk+aiohttp-2.48.0-6.hum1 noarch python3-sentry-sdk+asyncpg-2.48.0-6.hum1 noarch python3-sentry-sdk+bottle-2.48.0-6.hum1 noarch...