992321 matches found
Open Security Benchmark: Towards Autonomous Enterprise Cyber Defense
Enterprises are moving toward autonomous cyber defense: agentic AI that builds situational awareness of an organization's security state and reasons from it to assessments, decisions, and actions. This rests on a holistic view of the enterprise's security state, the continuous, cross-vendor pictu...
PT-2026-65700
A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-based SQL oracle via the SSO OAuth endpoint to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable...
PT-2026-65884
Dify AI Workflow oauth redirect url Open Redirect Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Dify. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a...
Linux Distros Unpatched Vulnerability : CVE-2026-64645
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a rewrites or redirects ru...
PT-2026-65742
Name of the Vulnerable Software and Affected Versions Apache Kyuubi versions 1.8.0 through 1.11.x Description The Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination. A remote requester with network access to the proxy can cause the server t...
CVE-2026-23904: Improper Restriction of Communication Channel to Intended Endpoints
Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination. A remote requester with network access to the proxy can cause the Kyuubi server to send HTTP requests to arbitrary reachable hosts, resulting in SSRF or open-proxy behavior. This...
Linux Distros Unpatched Vulnerability : CVE-2026-55995
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Double Free vulnerability in open-iscsi allows an unauthenticated MITM attacker to cause DoS. This issue affects open-iscsi: from ? through...
Linux Distros Unpatched Vulnerability : CVE-2026-44944
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An Incorrect Authorization vulnerability in open-iscsi allows unprivilidged local users to use the isscsiuio control socket. This issue affects open-iscsi: from...
PT-2026-65797
Name of the Vulnerable Software and Affected Versions open-iscsi versions prior to 56718d4e9d1a4f51c30697b5c0534144bb41c9bb Description A Double Free issue allows an unauthenticated man-in-the-middle MITM attacker to cause a denial of service DoS. A Double Free occurs when the program attempts to...
CVE-2026-52791: Incorrect Privilege Assignment
fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during openOTRUNC and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with...
CVE-2026-44944: Incorrect Authorization
An Incorrect Authorization vulnerability in open-iscsi allows unprivilidged local users to use the isscsiuio control socket. This issue affects open-iscsi: from ? through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e...
CVE-2026-44943: Improper Limitation of a Pathname to a Restricted Directory
An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in open-iscsi allows remote MITM attackers to create root-owned files outside the database and inject lines into the record. This issue affects open-iscsi: from through...
onionshare v2.6.5
OnionShare OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Installing OnionShare You can download OnionShare for Windows and macOS from the OnionShare website. For macOS you can also use Homebrew:...
CVE-2026-55391
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.63.0, datamodel-code-generator validates a URL host once in src/datamodelcodegenerator/http.py through...
Security Bulletin: Cargo in IBM Open SDK for Rust on AIX uses a vulnerable version of gix
Summary The cargo package manager in IBM Open SDK for Rust on AIX 1.92.0.2 and 1.94.0.0 uses gix and gix-submodule crates that are vulnerable to command injection. Vulnerability Details CVEID:CVE-2026-40034 DESCRIPTION: gix-submodule before 0.29.0 gitoxide before 0.5.21, gix before 0.84.0...
Security Bulletin: Cargo in IBM Open SDK for Rust on AIX uses a vulnerable version of the cargo crate
Summary The cargo package manager in IBM Open SDK for Rust on AIX 1.92.0.2 and 1.94.0.0 ships a version of the cargo crate that incorrectly handles symlinks inside tar balls. Vulnerability Details CVEID:CVE-2026-5222 DESCRIPTION: Cargo between 1.68 and 1.96 incorrectly normalized the URLs of...
Security Bulletin: Cargo in IBM Open SDK for Rust on AIX uses a vulnerable version of the openssl crate
Summary The cargo package manager in IBM Open SDK for Rust on AIX 1.92.0.2 and 1.94.0.0 ships a version of the openssl crate that contains multiple vulnerabilities. Vulnerability Details CVEID:CVE-2026-42327 DESCRIPTION: rust-openssl provides OpenSSL bindings for the Rust programming language. Fr...
Security Bulletin: Cargo in IBM Open SDK for Rust on AIX uses a vulnerable version of gix-fs
Summary The cargo package manager in IBM Open SDK for Rust on AIX 1.92.0.2 and 1.94.0.0 uses version 0.19 of the gix-fs crate which is vulnerable to improper link resolution before file access. Vulnerability Details CVEID:CVE-2026-44471 DESCRIPTION: gitoxide is an implementation of git written in...
CVE-2026-48058 nebula-mesh: Session and OIDC state cookies lack the Secure attribute
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/web/session.go and internal/web/oidc.go set HttpOnly and SameSite=Lax on every cookie but never Secure. A single plaintext request to the origin operator on a LAN, mistyped...
opencti v7.260728.0
Introduction OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. It has been created in order to structure, store, organize and visualize technical and non-technical information about cyber threats. The structuration of th...