17142 matches found
CVE-2026-73644
OpenDJ is affected by a vulnerability in the SASL PLAIN authorization identity path prior to version 5.1.2. The issue occurs when an authenticated account with the PROXIED_AUTH privilege does not properly evaluate the mayProxy proxy ACI scope for an authzid that resolves to a different user, allo...
Malicious code in functions-framework-nodejs (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4c9e327ae7e806fc6d270807180963349c0b7578b69f31336780d87323fdafa Package functions-framework-nodejs is a typosquat of Google's @google-cloud/functions-framework. Its package.json declares postinstall: node...
MAL-2026-13951 Malicious code in functions-framework-nodejs (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4c9e327ae7e806fc6d270807180963349c0b7578b69f31336780d87323fdafa Package functions-framework-nodejs is a typosquat of Google's @google-cloud/functions-framework. Its package.json declares postinstall: node...
CVE-2026-55982
OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes...
CVE-2026-55982
The Gitea application is vulnerable to an issue where the OIDC userinfo Endpoint returns identity claims without enforcing API token scopes . This vulnerability allows for the exposure of sensitive information to unauthorized actors. Remediation is available in Gitea v1.27.0 , which includes fixe...
CVE-2026-55982 OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes
OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes...
EUVD-2026-58138
OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes...
CVE-2026-55982 OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes
OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes...
CVE-2026-55982 OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes
OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes...
EUVD-2026-50562
Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials...
GHSA-H7P7-W5GC-XJ3W Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials
Summary A client that can submit message history to a Pydantic AI UI adapter can reference arbitrary files in the application's model-provider or cloud-storage account. The server forwards the reference to the model provider, which fetches it using the server's own credentials, allowing the clien...
CLEANSTART-2026-GR38496 Security fixes in aws-eks-pod-identity-agent 0.2.1-r1
Package aws-eks-pod-identity-agent version 0.2.1-r1 fixes 2 vulnerabilities: CVE-2026-46600, CVE-2026-56852...
CLEANSTART-2026-YY19713 Security fixes in keycloak 26.7.0-r1
Package keycloak version 26.7.0-r1 fixes 13 vulnerabilities: ghsa-rmj7-2vxq-3g9f, ghsa-j3rv-43j4-c7qm, ghsa-9fxm-vc8v-hj55, ghsa-5hh8-q8hv-fr38, ghsa-rcqc-6cw3-h962...
CLEANSTART-2026-QG86215 Security fixes in wso2is 7.1.0-r0
Package wso2is version 7.1.0-r0 fixes 17 vulnerabilities: CVE-2025-8671, CVE-2025-23184, CVE-2025-48734, CVE-2025-48795, CVE-2025-48924...
North Korean Remote Workers Are Infiltrating Government and Businesses: How to Expose Them Before Hiring
Companies are used to thinking about attackers as outsiders trying to break in. North Korean IT workers flip that model. They apply for jobs, pass interviews, receive legitimate credentials, and can end up inside the same systems companies spend millions trying to protect. That risk is no longer...
Security Bulletin: Security vulnerability has been found in IBM Verify Identity Access Digital Credentials (CVE-2026-16221)
Summary Security vulnerability has been addressed in IBM Verify Identity Access Digital Credentials Vulnerability Details CVEID:CVE-2026-16221 DESCRIPTION: Impact: fast-uri versions from 2.3.1 through 4.1.0 including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2 do not treat a literal...
CVE-2026-48791
sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...
CVE-2026-48791: Improper Verification of Cryptographic Signature
sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...
PT-2026-71726
Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description Remote attackers can bypass security restrictions because the system does not properly validate client-asserted identity. Recommendations At the moment, there is no information about a newer version...