992324 matches found
Security Bulletin: Cargo in IBM Open SDK for Rust on AIX uses a vulnerable version of gix-fs
Summary The cargo package manager in IBM Open SDK for Rust on AIX 1.92.0.2 and 1.94.0.0 uses version 0.19 of the gix-fs crate which is vulnerable to improper link resolution before file access. Vulnerability Details CVEID:CVE-2026-44471 DESCRIPTION: gitoxide is an implementation of git written in...
CVE-2026-48058 nebula-mesh: Session and OIDC state cookies lack the Secure attribute
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/web/session.go and internal/web/oidc.go set HttpOnly and SameSite=Lax on every cookie but never Secure. A single plaintext request to the origin operator on a LAN, mistyped...
opencti v7.260728.0
Introduction OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. It has been created in order to structure, store, organize and visualize technical and non-technical information about cyber threats. The structuration of th...
akto vmini-runtime-1.72.2
Akto.io API Security Contributors What is Akto? How it works • Getting-Started • API Inventory • API testing • Add Test • Join Discord community • Akto is an instant, open source API security platform that takes only 60 secs to get started. Akto is used by security teams to maintain a continuous...
CVE-2026-58227
creationtimestamp| type| source ---|---|--- 2026-07-28 17:22:23+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-erlang/otp-2...
CVE-2026-54603
OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, including OpenID Connect OIDC. From 0.4.0 to 2.0.21, a protocol-relative redirect Location returned to OAuth2::Clientrequest overrides the request authority, so the bearer Authorization header is sent to an...
UBUNTU-CVE-2026-54605
OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumertokenrequest parses the raw Location header of a 300 to 399 redirect returned by the OAuth server and follows the redirect recursively, which can mutate the consumer's...
SUSE CVE-2026-66032
libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftpopen function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSHFXPOPEN with SSHFXPSTATUS containin...
zaproxy w2026-07-28
The Zed Attack Proxy ZAP by Checkmarx is the world’s most widely used web app scanner. Free and open source. A community based GitHub Top 1000 project that anyone can contribute to. It can help you automatically find security vulnerabilities in your we...
EUVD-2026-49901
OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumertokenrequest parses the raw Location header of a 300 to 399 redirect returned by the OAuth server and follows the redirect recursively, which can mutate the consumer's...
CVE-2026-67178 Open Redirect in MISP Installer-Generated Apache Configuration
MISP installation scripts generated an Apache HTTP virtual-host configuration containing an incorrectly formatted HTTP-to-HTTPS redirect: Redirect permanent / https://misp.example Apache’s Redirect directive appends any portion of the requested path that follows the matched prefix to the configur...
CVE-2026-67178 Open Redirect in MISP Installer-Generated Apache Configuration
MISP installation scripts generated an Apache HTTP virtual-host configuration containing an incorrectly formatted HTTP-to-HTTPS redirect: Redirect permanent / https://misp.example Apache’s Redirect directive appends any portion of the requested path that follows the matched prefix to the configur...
CVE-2026-67178
CVE-2026-67178 affects MISP installations where Apache virtual-host redirects were generated without a trailing slash, causing an open redirect vulnerability. The Redirect directive uses the destination as a host if the trailing slash is missing, enabling an attacker to craft URLs like http://mis...
opencode v1.18.8
The open source AI coding agent. English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dansk | 日本語 | Polski | Русский | Bosanski | العربية | Norsk | Português Brasil | ไทย | Türkçe | Українська | বাংলা | Ελληνικά | Tiếng Việt Installation root@kitploit: YOLO curl -fsSL...
EUVD-2026-29482
Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions...
Vulnera
Strix The open-source AI pentesting tool. Autonomous AI h...
CVE-2026-64645
A flaw was found in Next.js, a React framework for building web applications. This vulnerability allows a remote attacker to perform Server-Side Request Forgery SSRF or Open Redirect attacks. When a rewrites or redirects rule constructs an external destination hostname using attacker-controlled...
WordPress Ultimate Member <2.1.7 - Open Redirect Detection
WordPress Ultimate Member plugin before 2.1.7 contains an open redirect vulnerability on the registration and login pages via the "redirectto" GET parameter. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized...
IceWarp Mail Server ≤11.4.0 - Open Redirect Detection
IceWarp Mail Server version 11.4.0 and below contains an open redirect vulnerability that allows attackers to redirect users to arbitrary external domains through malicious URLs. !/usr/bin/env python3 -- coding: utf-8 -- """IceWarp Mail Server version 11.""" import re from kittysploit import from...
Payment Gateway for Telcell < 2.0.4 - Open Redirect Detection
The plugin does not validate the apiurl parameter before redirecting the user to its value, leading to an Open Redirect issue !/usr/bin/env python3 -- coding: utf-8 -- """The plugin does not validate the apiurl parameter before redirecting the user to its value, leading to an Ope.""" import re fr...