CVE-2026-82754

Improper Protection of Alternate Path vulnerability in ash-project ashauthenticationoauth2server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix. oauth2serverprotocolroutes/1 in...

CVE-2026-82754 ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls

Improper Protection of Alternate Path vulnerability in ash-project ashauthenticationoauth2server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix. oauth2serverprotocolroutes/1 in...

CVE-2026-82754

An Improper Protection of Alternate Path vulnerability in the ash_authentication_oauth2_server Elixir library (versions 0.1.0 through before 0.3.1) causes state-changing OAuth endpoints to be reachable under an unintended URL prefix. The oauth2_server_protocol_routes/1 function in the Phoenix rou...

CVE-2026-82754 ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls

Improper Protection of Alternate Path vulnerability in ash-project ashauthenticationoauth2server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix. oauth2serverprotocolroutes/1 in...

EUVD-2026-72536

Improper Protection of Alternate Path vulnerability in ash-project ashauthenticationoauth2server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix. oauth2serverprotocolroutes/1 in...

EEF-CVE-2026-82754 ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls

Summary Improper Protection of Alternate Path vulnerability in ash-project ashauthenticationoauth2server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix. oauth2serverprotocolroutes/1 in...

Linux Distros Unpatched Vulnerability : CVE-2026-78123

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - strongSwan 5.0.2 through 6.0.7 has an Expired Pointer Dereference in PKCS7 parsing in the openssl plugin. CVE-2026-78123 Note that Nessus relies on the presence...

PT-2026-86924

Improper Protection of Alternate Path vulnerability in ash-project ash authentication oauth2 server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix. oauth2 server protocol routes/1 in...

CVE-2026-82754: Improper Protection of Alternate Path

Improper Protection of Alternate Path vulnerability in ash-project ashauthenticationoauth2server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix. oauth2serverprotocolroutes/1 in...

Linux Distros Unpatched Vulnerability : CVE-2026-78129

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - strongSwan 4.6.2 through 6.0.7 has an infinite loop in PKCS5 decryption. CVE-2026-78129 Note that Nessus relies on the presence of the package as reported by th...

Linux Distros Unpatched Vulnerability : CVE-2026-78124

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - strongSwan 5.0.2 through 6.0.7 allows PKCS7 certificate enumeration in the openssl plugin that leads to a lack of release of memory after its effective lifetime...

CVE-2026-67276

creationtimestamp| type| source ---|---|--- 2026-09-05 20:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3muse5sihmx2j 2026-09-05 22:00:02+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/4974c0db-04af-472f-a69e-78bc275e7d1b 2026-09-...

CVE-2026-67277

creationtimestamp| type| source ---|---|--- 2026-09-05 20:20:30+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117220286803293141 2026-09-05 22:00:02+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/1d9ea784-c941-41ec-aa5f-c1cb172bcb68 2026-09-0...

Linux Distros Unpatched Vulnerability : CVE-2026-81738

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to trigger an out- of-bounds write via crafted DOMAIN-SEARCH entries...

Linux Distros Unpatched Vulnerability : CVE-2026-82312

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenVPN 2.0.0 through 2.6.22 and 2.7alpha1 through 2.7.6 on Windows allows local authenticated users to cause a denial of service via a NULL DACL on named IPC...

@01.software/cli (>=0.3.0, <=0.10.3), @01.software/sdk (>=0.4.0, <=0.29.0) +1985 more potentially affected by CVE-2026-84961 via undici (>=7.24.1, <=7.29.0)

undici NPM version =7.24.1, =0.3.0, =0.4.0, =0.4.0, =1.0.0, =0.6.0, =0.1.0, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.260505.5, =0.260605.2 and more Source cves: CVE-2026-84961 Source advisory: SNYK:JS-UNDICI-19635218...

@01.software/cli (>=0.1.1, <=0.10.3), @01.software/sdk (>=0.0.1-251008.90016, <=0.29.0) +2296 more potentially affected by CVE-2026-84933 via undici (>=7.0.0, <=7.29.0)

undici NPM version =7.0.0, =0.1.1, =0.0.1-251008.90016, =0.4.0, =1.0.0, =0.6.0, =0.1.0, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.260505.5, =0.260605.2 and more Source cves: CVE-2026-84933 Source advisory: SNYK:JS-UNDICI-19635216...

3xhaustpi (>=0.1.3, <=0.2.5), @0x0.bug/pi-coding-agent (>=1.0.0, <=1.0.9) +1677 more potentially affected by CVE-2026-18149 via undici (>=8.0.0, <=8.10.1)

undici NPM version =8.0.0, =0.1.3, =1.0.0, =0.1.0, =0.3.5, =1.0.0, =0.2.0, =5.0.1-staging.19033314d476, =5.0.1-staging.19033314d476, =5.1.1-staging.00ceebd28cf2, =5.1.1-staging.00ceebd28cf2, =5.0.1-staging.19033314d476, =5.0.1-staging.3abdf9534c25, =5.0.1-staging.daf8e165bc4a -...

CVE-2026-69657

XING CPTrans-ME-X contains a Use of Default Password CWE-1393. Anyone with the knowledge of the credential may log in to the affected device...

Linux Distros Unpatched Vulnerability : CVE-2026-76925

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Flatpak. A Time-of-check to time-of-use TOCTOU race condition exists in the org.freedesktop.Flatpak.SystemHelper component. This vulnerabili...