38 matches found
EUVD-2026-84943
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to bypass security controls by forging user identities due to improper authorization...
CVE-2026-18156
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to bypass security controls by forging user identities due to improper authorization...
CVE-2026-18156
IBM Financial Transaction Manager (FTM) for RedHat OpenShift is affected by CVE-2026-18156 , where a remote authenticated attacker could bypass security controls by forging user identities due to improper authorization (CWE-862 ). The vulnerability has a CVSS base score of 6.5 . Affected versions...
CVE-2026-59243
CVE-2026-59243 — Apache Airflow FAB Auth Manager JWT署名検証バイパス 韓国語: README.ko.md Apache勧告: https://lists.apache.org/thread/x4784l7z00tl3gw4tv2dmvoon77rxgpl 2026-07-29公開 CVEレコード: https://vulners.com/cve/CVE-2026-59243 修正バージョン: apache-airflow-providers-fab==3.7.3 分類: CWE-347、事前認証JWT署名検証バイパス → 管理者乗っ取り...
CVE-2026-57147: Use of Hard-coded Credentials
PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonaiplatform/services/authservice.py assigns the public dev-secret-change-me value to JWTSECRET when PLATFORMJWTSECRET is unset, and its production guard does not run when PLATFORMENV is also unset because that setting defaults to dev....
CVE-2026-90467
aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or...
CVE-2026-90467
aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or...
UBUNTU-CVE-2026-90467
aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or...
CVE-2026-90467 aiosmtplib before 5.1.3 ESMTP Parameter Injection via unvalidated addresses
aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or...
CVE-2026-90467
aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or...
Linux Distros Unpatched Vulnerability : CVE-2026-90467
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO...
PT-2026-90555
aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or...
CVE-2026-89043: Improper Verification of Cryptographic Signature
passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets...
CVE-2026-85432
MOOS core-moos through 10.4.0, an underwater robotics middleware, contains a message source spoofing flaw in its MOOSDB message processing layer. The root cause is a failure to validate client identity: the system trusts wire-supplied source identifiers in serialized messages rather than the auth...
CVE-2026-75415
AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java retrieves the userid from the request header as the core of the identity verification mechanism, allowing attackers to forge any user identity credential information, thereby causing sensitive...
EUVD-2026-66748
AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java retrieves the userid from the request header as the core of the identity verification mechanism, allowing attackers to forge any user identity credential information, thereby causing sensitive...
CVE-2026-75415
AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java retrieves the userid from the request header as the core of the identity verification mechanism, allowing attackers to forge any user identity credential information, thereby causing sensitive...
CVE-2026-75415
AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java retrieves the userid from the request header as the core of the identity verification mechanism, allowing attackers to forge any user identity credential information, thereby causing sensitive...
CVE-2026-75415
AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java retrieves the userid from the request header as the core of the identity verification mechanism, allowing attackers to forge any user identity credential information, thereby causing sensitive...
CVE-2026-53832 OpenClaw < 2026.5.18 - Identity Header Forgery via Trusted-Proxy Configuration
OpenClaw before 2026.5.18 contains an identity header validation vulnerability allowing local same-host callers to forge trusted-proxy identity headers. Attackers with access to the proxy-facing Gateway port can supply forged identity headers to assume operator identity and potentially escalate...