CVE-2026-27446 Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation

Missing Authentication for Critical Function CWE-306 vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. This cou...

CVE-2026-27446 Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation

Missing Authentication for Critical Function CWE-306 vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. This cou...

CVE-2026-27446

CVE-2026-27446 affects Apache Artemis and Apache ActiveMQ Artemis. The vulnerability enables an unauthenticated remote attacker to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker, potentially allowing message injection into any queu...

PT-2026-22892

Name of the Vulnerable Software and Affected Versions Apache Artemis versions 2.50.0 through 2.51.0 Apache ActiveMQ Artemis versions 2.11.0 through 2.44.0 Description A missing authentication check for a critical function exists in Apache Artemis and Apache ActiveMQ Artemis. An unauthenticated...

WSO2 API Manager和WSO2 Identity Server（IS） 安全漏洞

WSO2 API Manager and WSO2 Identity Server are both products of the American company WSO2. WSO2 API Manager is a set of API lifecycle management solutions. WSO2 Identity Server is an identity authentication server. Both WSO2 API Manager and WSO2 Identity Server have security vulnerabilities. These...

authentik 数据伪造问题漏洞

Authentik is an open-source identity provisioning application developed by Authentik. Versions of Authentik prior to 2025.8.6, 2025.10.4, and 2025.12.4 had a data manipulation vulnerability. This vulnerability arises from the use of certain configured SAML sources, allowing attackers to inject...

SUSE-SU-2026:20232-1 Security update for golang-github-prometheus-prometheus

This update for golang-github-prometheus-prometheus fixes the following issues: Update to version 3.5.0: Security issues fixed: - CVE-2025-13465: prototype pollution in the .unset and .omit functions can lead to deletion of methods from global bsc1257329. - CVE-2025-12816: interpretation conflict...

CVE-2025-69205

Micro Registration Utility µURU is a telephone self registration utility based on asterisk. In versions up to and including commit 88db9a953f38a3026bcd6816d51c7f3b93c55893, an attacker can crafts a special federation name and characters treated special by asterisk can be injected into the Dial...

CVE-2025-69205

Micro Registration Utility µURU is a telephone self registration utility based on asterisk. In versions up to and including commit 88db9a953f38a3026bcd6816d51c7f3b93c55893, an attacker can crafts a special federation name and characters treated special by asterisk can be injected into the Dial...

CVE-2025-69205 In µURU, a Specially Crafted Federation Name Allows Dialplan Injection

Micro Registration Utility µURU is a telephone self registration utility based on asterisk. In versions up to and including commit 88db9a953f38a3026bcd6816d51c7f3b93c55893, an attacker can crafts a special federation name and characters treated special by asterisk can be injected into the Dial...

CVE-2025-69205 In µURU, a Specially Crafted Federation Name Allows Dialplan Injection

Micro Registration Utility µURU is a telephone self registration utility based on asterisk. In versions up to and including commit 88db9a953f38a3026bcd6816d51c7f3b93c55893, an attacker can crafts a special federation name and characters treated special by asterisk can be injected into the Dial...

EUVD-2025-205640

Micro Registration Utility µURU is a telephone self registration utility based on asterisk. In versions up to and including commit 88db9a953f38a3026bcd6816d51c7f3b93c55893, an attacker can crafts a special federation name and characters treated special by asterisk can be injected into the Dial...

CVE-2025-69205

The CVE-2025-69205 entry affects Micro Registration Utility (µURU), a telephony self-registration tool built on top of Asterisk. The vulnerability occurs in versions up to commit 88db9a953f38a3026bcd6816d51c7f3b93c55893, where an attacker can craft a special federation name containing characters ...

CVE-2025-69205 In µURU, a Specially Crafted Federation Name Allows Dialplan Injection

Micro Registration Utility µURU is a telephone self registration utility based on asterisk. In versions up to and including commit 88db9a953f38a3026bcd6816d51c7f3b93c55893, an attacker can crafts a special federation name and characters treated special by asterisk can be injected into the Dial...

PT-2025-53800

Name of the Vulnerable Software and Affected Versions Micro Registration Utility µURU versions up to and including commit 88db9a953f38a3026bcd6816d51c7f3b93c55893 Description The Micro Registration Utility µURU, a telephone self registration utility based on asterisk, contains a flaw due to...

CVE-2025-68667 Conduit-derived homeservers are affected by a Confused Deputy and Improper Input Validation issue

Conduit is a chat server powered by Matrix. A vulnerability that affects a number of Conduit-derived homeservers allows a remote, unauthenticated attacker to force the target server to cryptographically sign arbitrary membership events. Affected products include Conduit prior to version 0.10.10,...

CVE-2025-68667 Conduit-derived homeservers are affected by a Confused Deputy and Improper Input Validation issue

Conduit is a chat server powered by Matrix. A vulnerability that affects a number of Conduit-derived homeservers allows a remote, unauthenticated attacker to force the target server to cryptographically sign arbitrary membership events. Affected products include Conduit prior to version 0.10.10,...

CVE-2025-68667

Conduit-derived homeservers are vulnerable to a signed membership event forgery due to lack of origin validation on signing requests. Affected: Conduit <0.10.10; continuwuity <0.5.0; Grapevine ; tuwunel

CVE-2025-68667 Conduit-derived homeservers are affected by a Confused Deputy and Improper Input Validation issue

Conduit is a chat server powered by Matrix. A vulnerability that affects a number of Conduit-derived homeservers allows a remote, unauthenticated attacker to force the target server to cryptographically sign arbitrary membership events. Affected products include Conduit prior to version 0.10.10,...

PT-2025-52860

Name of the Vulnerable Software and Affected Versions continuwuity versions prior to 0.5.0 Description A remote, unauthenticated attacker can force the target server to cryptographically sign arbitrary membership events. This occurs because the server does not validate the origin of a signing...