56676 matches found
CVE-2026-93601
A flaw was found in rustls-webpki. This component incorrectly processes DNS Domain Name System name constraints for certificates asserting a wildcard name. This could allow a misissued wildcard certificate to be accepted for a domain that should be outside its permitted scope. Consequently, this...
GHSA-9Q4H-F4X5-FFQ8 Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher
Summary The V1 DurableTask stream handler registers worker-supplied durable task external IDs in an in-memory callback routing map before verifying that the authenticated tenant owns the task. If the tenant-scoped ownership check fails, the handler logs the error and continues, but the map entry...
Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme
Summary The @novu/js In-App Inbox renderer passes a notification's redirect.url to window.open with no URL-scheme validation. The value originates from a notification's call-to-action and is delivered to the recipient verbatim. An authenticated organization member or any holder of the environment...
CVE-2026-76715
A vulnerability in an administrative component of the HPE Networking Analytics and Location Engine (ALE) allows an unauthenticated remote attacker to perform a man-in-the-middle (MitM) attack. Successful exploitation can lead to remote code execution with root privileges on the affected appliance...
CVE-2026-76715 Unauthenticated Man-in-the-Middle Attach Leads to Remote Code Execution Vulnerability in HPE Networking Analytics and Location Engine (ALE)
A vulnerability in an administrative component of Analytics and Location Engine ALE is vulnerable to a man-in-the-middle MitM attack. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code with root privileges on the affected applian...
CVE-2026-76715 Unauthenticated Man-in-the-Middle Attach Leads to Remote Code Execution Vulnerability in HPE Networking Analytics and Location Engine (ALE)
A vulnerability in an administrative component of Analytics and Location Engine ALE is vulnerable to a man-in-the-middle MitM attack. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code with root privileges on the affected applian...
CVE-2026-58269
creationtimestamp| type| source ---|---|--- 2026-09-22 16:35:11+00:00| published-proof-of-concept| https://github.com/Sync-in/server/security/advisories/GHSA-92cr-jxw4-5wjg...
CVE-2026-58270
creationtimestamp| type| source ---|---|--- 2026-09-22 16:35:08+00:00| published-proof-of-concept| https://github.com/Sync-in/server/security/advisories/GHSA-jx63-h26r-8cph 2026-09-22 19:32:27+00:00| seen| https://gist.github.com/alon710/b536815814568f1fe4f87321daa1216e...
CVE-2026-58272
creationtimestamp| type| source ---|---|--- 2026-09-22 16:31:56+00:00| seen| https://gist.github.com/alon710/0d291d38492cd0f426b608e184326562 2026-09-22 16:35:04+00:00| published-proof-of-concept| https://github.com/Sync-in/server/security/advisories/GHSA-29hq-23m2-2j47...
CVE-2026-94640
A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by sending a large number of unique requests. The rpcbind service records previously unseen RPC Remote Procedure Call statistics in unbounded in-memory lists, leading to...
CVE-2026-75510
Novu's @novu/js In-App Inbox and @novu/react Inbox components (prior to version 3.18.0 ) are vulnerable to Stored XSS due to a lack of URL-scheme validation. An authenticated organization member or API-key holder can create a v1 in-app workflow with a call-to-action containing a javascript: redir...
CVE-2026-75510 Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme
Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu's @novu/js In-App Inbox and the @novu/react Inbox component accept a notification call-to-action redirect.url from the v1 cta.data object and pass it through...
CVE-2026-75510 Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme
Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu's @novu/js In-App Inbox and the @novu/react Inbox component accept a notification call-to-action redirect.url from the v1 cta.data object and pass it through...
EUVD-2026-84535
Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu's @novu/js In-App Inbox and the @novu/react Inbox component accept a notification call-to-action redirect.url from the v1 cta.data object and pass it through...
EUVD-2026-84199
Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login incomplete fix of the prior timing-attack advisory...
Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)
Summary validateUser in backend/src/authentication/providers/mysql/auth-provider-mysql.service.ts returns immediately when the supplied login/email does not match any account, without ever calling comparePassword: async validateUserloginOrEmail: string, password: string, ip?: string, scope?:...
EUVD-2026-84198
Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff pathFilters...
GHSA-JX63-H26R-8CPH Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`
Affected component: Sync-in Server v2.3.0, POST /api/app/sync/operation/diff/:id, vulnerable implementation of pathFilters in backend/src/applications/sync/dtos/sync-operations.dto.ts. Summary In the vulnerable version, the sync diff endpoint accepted a user-controlled regex pattern through...
Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`
Affected component: Sync-in Server v2.3.0, POST /api/app/sync/operation/diff/:id, vulnerable implementation of pathFilters in backend/src/applications/sync/dtos/sync-operations.dto.ts. Summary In the vulnerable version, the sync diff endpoint accepted a user-controlled regex pattern through...