990549 matches found
PT-2026-85524
Holloway Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the Alpha user and root user password loops of Shell/debian-minbase-install.sh. The installer invokes mkpasswd to generate yescrypt password hashes but does not check the command's...
TIER: Threat Implicitness Benchmark for Evaluating LLM Safety Behaviors
Current LLM safety benchmarks largely rely on binary metrics, overlooking how models respond to harmful prompts with varying threat implicitness. We introduce TIER, a Threat Implicitness Benchmark for behavioral safety evaluation of LLMs. TIER covers four risk domains and four threat levels, from...
CVE-2026-49509
CVE-2026-49509 is an out-of-bounds read vulnerability in Samsung Opensource Escargot , a JavaScript engine, that allows overread of buffers. The affected commit is 25648aef19187b3f87f4d9420b8d761453ad4630. The CNA-assigned CVSS 3.1 score is 4.4 (MEDIUM) , with a local attack vector, low complexit...
CVE-2026-66393 vulnerabilities
Vulnerabilities for packages: apache-beam-python-3.12-sdk, apache-beam-python-3.11-sdk, open-webui, label-studio, apache-beam-python-3.13-sdk, nemo, kubeflow-pipelines-visualization-server, py3-nltk...
GHSA-CV2G-M8RR-888C vulnerabilities
Vulnerabilities for packages: apache-beam-python-3.12-sdk, apache-beam-python-3.11-sdk, open-webui, label-studio, apache-beam-python-3.13-sdk, nemo, kubeflow-pipelines-visualization-server, py3-nltk...
GHSA-CV2G-M8RR-888C vulnerabilities
Vulnerabilities for packages: open-webui, kubeflow-pipelines-visualization-server, py3-nltk...
CVE-2026-66393 vulnerabilities
Vulnerabilities for packages: open-webui, kubeflow-pipelines-visualization-server, py3-nltk...
CVE-2026-53728
Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly...
CVE-2026-49456
Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstableredirect helper exported from waku/router/server packages/waku/src/router/define-router.tsx:156–161 accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation,...
Security Bulletin: MongoDB Enterprised Advanced affected by: Open Redirect (CVE-2026-40181)
Summary There are vulnerabilities in router-1.23.2.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-40181. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-40181 DESCRIPTION: React Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7...
CVE-2026-53728 Medplum - Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage
Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly...
EUVD-2026-70698
Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly...
EUVD-2026-70655
Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstableredirect helper exported from waku/router/server packages/waku/src/router/define-router.tsx:156–161 accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation,...
CVE-2026-49456
Waku (the minimal React framework) prior to version 1.0.0-beta.1 is vulnerable to an open redirect via the unstable_redirect() helper in waku/router/server. The function reflects user-supplied strings unchanged into the HTTP Location header with no URL validation, scheme restriction, or path-only...
CVE-2026-49456 Waku: Open Redirect via `unstable_redirect` Helper
Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstableredirect helper exported from waku/router/server packages/waku/src/router/define-router.tsx:156–161 accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation,...
CVE-2026-49456 Waku: Open Redirect via `unstable_redirect` Helper
Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstableredirect helper exported from waku/router/server packages/waku/src/router/define-router.tsx:156–161 accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation,...
CVE-2026-49456 Waku: Open Redirect via `unstable_redirect` Helper
Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstableredirect helper exported from waku/router/server packages/waku/src/router/define-router.tsx:156–161 accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation,...
EmailXpose — Updated!
EmailXpose Specification AI-Powered Email Clarity HTML Mirror: https://roxanneardary.com/emailxpose-specification/ Specification Overview EmailXpose is an open source, modular AI email security and intelligence system designed to analyze email content, sender identity, links, attachments, images,...
SUSE CVE-2026-18329
Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when a jsaccess handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker ca...
OPENSUSE-SU-2026:21795-1 Security update for python-Authlib
This update for python-Authlib fixes the following issues: Changes in python-Authlib: - CVE-2026-41479: Open Redirect vulnerability via crafted authorization requests bsc1275231...