73 matches found
CVE-2026-123485
Ground Station from 0.6.0 before 0.8.20 does not restrict the get-orbital-sources Socket.IO handler also exposed as get-tle-sources to administrators, although the orbital-source write handlers are admin-only. An authenticated operator-role user can call either handler to retrieve the plaintext...
CVE-2026-123485 Ground Station 0.6.0 before 0.8.20 Credential Disclosure via get-orbital-sources
Ground Station from 0.6.0 before 0.8.20 does not restrict the get-orbital-sources Socket.IO handler also exposed as get-tle-sources to administrators, although the orbital-source write handlers are admin-only. An authenticated operator-role user can call either handler to retrieve the plaintext...
EUVD-2026-118285
Ground Station from 0.6.0 before 0.8.20 does not restrict the get-orbital-sources Socket.IO handler also exposed as get-tle-sources to administrators, although the orbital-source write handlers are admin-only. An authenticated operator-role user can call either handler to retrieve the plaintext...
CVE-2026-123485
Ground Station from 0.6.0 before 0.8.20 does not restrict the get-orbital-sources Socket.IO handler also exposed as get-tle-sources to administrators, although the orbital-source write handlers are admin-only. An authenticated operator-role user can call either handler to retrieve the plaintext...
CVE-2026-123485 Ground Station 0.6.0 before 0.8.20 Credential Disclosure via get-orbital-sources
Ground Station from 0.6.0 before 0.8.20 does not restrict the get-orbital-sources Socket.IO handler also exposed as get-tle-sources to administrators, although the orbital-source write handlers are admin-only. An authenticated operator-role user can call either handler to retrieve the plaintext...
CVE-2026-123485
The Ground Station software (versions 0.6.0 before 0.8.20) is vulnerable to credential disclosure because the get-orbital-sources Socket.IO handler (also exposed as get-tle-sources ) lacks administrator-only restrictions. While write handlers are protected, an authenticated user with an operator-...
CVE-2026-123485: sgoudelis ground-station: Ground Station from 0.6.0 before 0.8.20 does not restrict the get-orbital-sources Socket.IO handler (also exposed as…
Ground Station from 0.6.0 before 0.8.20 does not restrict the get-orbital-sources Socket.IO handler also exposed as get-tle-sources to administrators, although the orbital-source write handlers are admin-only. An authenticated operator-role user can call either handler to retrieve the plaintext...
PYSEC-2026-3676 Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for GHSA-54vg-pfh7-jq95)
Summary The SSRF mitigation added for GHSA-54vg-pfh7-jq95 validaterevocationurl in lemur /certificates/verify.py can be bypassed. An operator-role user who uploads a certificate with attacker-controlled CRL/OCSP extensions can still make Lemur reach internal destinations RFC1918, loopback,...
Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for GHSA-54vg-pfh7-jq95)
Summary The SSRF mitigation added for GHSA-54vg-pfh7-jq95 validaterevocationurl in lemur /certificates/verify.py can be bypassed. An operator-role user who uploads a certificate with attacker-controlled CRL/OCSP extensions can still make Lemur reach internal destinations RFC1918, loopback,...
PT-2026-80270
Summary The SSRF mitigation added for GHSA-54vg-pfh7-jq95 validate revocation url in lemur /certificates/verify.py can be bypassed. An operator-role user who uploads a certificate with attacker-controlled CRL/OCSP extensions can still make Lemur reach internal destinations RFC1918, loopback,...
PT-2026-59241
Summary When verifying an uploaded certificate, lemur/certificates/verify.py extracts the CRL Distribution Point URL and the OCSP responder URL directly from the certificate's extensions and issues outbound requests to those URLs without scheme restriction or destination allow-listing. An...
Lemur: Crafted CRL/OCSP URLs in uploaded certificates lead to post-authentication SSRF
Summary When verifying an uploaded certificate, lemur/certificates/verify.py extracts the CRL Distribution Point URL and the OCSP responder URL directly from the certificate's extensions and issues outbound requests to those URLs without scheme restriction or destination allow-listing. An...
CVE-2026-22683
Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API. Although Operators are documented and priced as unable to create or modify entities,...
EUVD-2026-19747
Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API. Although Operators are documented and priced as unable to create or modify entities,...
CVE-2026-22683
Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API. Although Operators are documented and priced as unable to create or modify entities,...
CVE-2026-22683 Windmill < 1.615.0 Operator Role Missing Authorization Checks RCE
Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API. Although Operators are documented and priced as unable to create or modify entities,...
CVE-2026-22683 Windmill < 1.615.0 Operator Role Missing Authorization Checks RCE
Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API. Although Operators are documented and priced as unable to create or modify entities,...
CVE-2026-22683
Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API. Although Operators are documented and priced as unable to create or modify entities,...
CVE-2026-22683
CVE-2026-22683 affects Windmill versions 1.56.0–1.614.0, where missing authorization checks on the Operator role allow prohibited entity creation and modification via the backend API. Operators can create/update scripts, flows, apps, and raw_apps, and can execute scripts via the jobs API, enablin...
CVE-2026-22683
Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API. Although Operators are documented and priced as unable to create or modify entities,...