317983 matches found
google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 :path pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed :path that omits the mandato...
net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls
A flaw was found in the net/http/httputil package, specifically within the ReverseProxy component. This vulnerability allows the ReverseProxy to forward query parameters that are not visible to Rewrite functions. This occurs because the ReverseProxy does not correctly consider the url.ParseQuery...
CVE-2026-79776
A flaw was found in rclone. A remote attacker can bypass the authentication mechanism by accessing the /debug/pprof/cmdline endpoint. This vulnerability occurs because the pprof debug handler is mounted as its own router route, bypassing the main handler's authentication rule. Successful...
CVE-2026-82725 AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data
Authorization Bypass Through User-Controlled Key vulnerability in ash-project ashphoenix lets an attacker who controls filter form parameters filter across relationships the resource author marked non-public, turning the returned rows into a boolean oracle over private related data...
CVE-2026-82727 AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashphoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page. When AshPhoenix.Form.Au...
CVE-2026-82727
ash_phoenix (by ash-project) has a sensitive information disclosure in AshPhoenix.Form.Auto 's union sub-form handling. When the submitted _union_type parameter does not match a configured type, the raised error message embeds the full raw parameter map via inspect(params, pretty: true). Because ...
EUVD-2026-68334
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashphoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page. When AshPhoenix.Form.Au...
CVE-2026-82727 AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashphoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page. When AshPhoenix.Form.Au...
xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component
A flaw was found in the XMLRPC-C Library. This reflected cross-site scripting XSS vulnerability exists in the error page component. A remote attacker could exploit this by tricking a user into clicking a specially crafted link. Successful exploitation could lead to the execution of malicious...
CVE-2026-82580
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashai discloses internal error text to chat users. In AshAi.ToolLoop and AshAi.Tools, an exception raised while executing a tool was serialized verbatim with Exception.message/1 into the tool-result content...
CVE-2026-75760
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashai discloses provider request state and credentials in a user-facing validation error. In AshAi.Changes.Vectorize, when the embedding provider call fails the change added a changeset error whose message...
MINI-7CXC-R5C8-6CGM
Bulletin has no description...
MINI-7FRC-8MRW-H5P8
Bulletin has no description...
MINI-8XF6-FR7H-F5G7
Bulletin has no description...
MINI-5G3V-R6CH-M787
Bulletin has no description...
MINI-5XH9-3623-9954
Bulletin has no description...
xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component
A flaw was found in the XMLRPC-C Library. This reflected cross-site scripting XSS vulnerability exists in the error page component. A remote attacker could exploit this by tricking a user into clicking a specially crafted link. Successful exploitation could lead to the execution of malicious...
CVE-2026-75760 AshAi vectorize change leaks raw embedding-provider errors, including credentials, in a user-facing error
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashai discloses provider request state and credentials in a user-facing validation error. In AshAi.Changes.Vectorize, when the embedding provider call fails the change added a changeset error whose message...
EUVD-2026-68309
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashai discloses provider request state and credentials in a user-facing validation error. In AshAi.Changes.Vectorize, when the embedding provider call fails the change added a changeset error whose message...
CVE-2026-75760 AshAi vectorize change leaks raw embedding-provider errors, including credentials, in a user-facing error
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashai discloses provider request state and credentials in a user-facing validation error. In AshAi.Changes.Vectorize, when the embedding provider call fails the change added a changeset error whose message...