pub

❤ Soyez un héros, offrez une 🍺 🙂 ⟶ Ƀ : 1AZMeGVfCBbYwVYyG9s79pJDyocTZgiApa | Ξth : 0x438B38E30eF117C15fBfF833f9C2c70182925815 PoCs d'exploitation et outils pour les vulnérabilités divulguées par tintinweb. pub police line - do not cross ==== police line - do not cross ==== police line - do not cro...

Erlang/OTP 17.0 < 27.3.4.18 / 28.0 < 28.5.0.7 / 29.0 < 29.1.1 ASN.1 OBJECT IDENTIFIER Decoder DoS (CVE-2026-65634)

The version of Erlang/OTP installed on the remote host is 17.0 prior to 27.3.4.18, 28.0 prior to 28.5.0.7, or 29.0 prior to 29.1.1. It is, therefore, affected by a vulnerability: - Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated...

PT-2026-79975

Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted data as input, decryption will succeed...

CVE-2026-73405 Authorization Bypass in SSE Pub/Sub Allows Unconfirmed Accounts to Access Stream Events in vulnerability-lookup

An authorization bypass vulnerability in Vulnerability-Lookup allowed inactive or unconfirmed accounts to subscribe to Server-Sent Events SSE streams through the /pubsub/subscribe/ endpoint. The tokenrequired decorator used by the Pub/Sub interface authenticated requests solely by matching the...

CVE-2026-73405

CVE-2026-73405 describes an authorization bypass in Vulnerability-Lookup where the Pub/Sub SSE interface allowed unconfirmed/inactive accounts to subscribe to /pubsub/subscribe/ due to token_required only validating the API key, not is_active/is_confirmed. This created a boundary mismatch with th...

CVE-2026-73405

An authorization bypass vulnerability in Vulnerability-Lookup allowed inactive or unconfirmed accounts to subscribe to Server-Sent Events SSE streams through the /pubsub/subscribe/ endpoint. The tokenrequired decorator used by the Pub/Sub interface authenticated requests solely by matching the...

CVE-2026-73405 Authorization Bypass in SSE Pub/Sub Allows Unconfirmed Accounts to Access Stream Events in vulnerability-lookup

An authorization bypass vulnerability in Vulnerability-Lookup allowed inactive or unconfirmed accounts to subscribe to Server-Sent Events SSE streams through the /pubsub/subscribe/ endpoint. The tokenrequired decorator used by the Pub/Sub interface authenticated requests solely by matching the...

CVE-2026-73405 Authorization Bypass in SSE Pub/Sub Allows Unconfirmed Accounts to Access Stream Events in vulnerability-lookup

An authorization bypass vulnerability in Vulnerability-Lookup allowed inactive or unconfirmed accounts to subscribe to Server-Sent Events SSE streams through the /pubsub/subscribe/ endpoint. The tokenrequired decorator used by the Pub/Sub interface authenticated requests solely by matching the...

Improper Input Validation

Apache Camel is vulnerable to Improper Input Validation. The vulnerability is due to the Dapr Pub/Sub consumer copying attacker-controlled CloudEvent fields into producer routing headers, which allows an attacker with permission to publish to the subscribed topic to manipulate the destination and...

CVE-2026-58262

Klever-Go (Go implementation of the Klever blockchain protocol) contains a vulnerability prior to version 1.7.20 in header signature verification. The verification counts unused padding bits of the PubKeysBitmap toward the two-thirds validator quorum. These padding bits do not correspond to any v...

CVE-2026-58262 Klever-Go: PubKeysBitmap padding bits bypass the BLS signature quorum

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, header signature verification counts the unused padding bits of the PubKeysBitmap toward the two-thirds validator quorum. These padding bits do not correspond to any validator and are ignored by the actual BLS...

CVE-2026-58262

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, header signature verification counts the unused padding bits of the PubKeysBitmap toward the two-thirds validator quorum. These padding bits do not correspond to any validator and are ignored by the actual BLS...

[SECURITY] Fedora 43 Update: valkey-8.1.9-1.fc43

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing s...

[SECURITY] Fedora 44 Update: valkey-9.0.5-1.fc44

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing s...

CVE-2026-65618 Improper URL validation when handling specific URLs Pub, Terraform and Docker packages might lead to SSRF vulnerability

Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog Artifactory, potentially exposing internal services and cached response data...

CVE-2026-65618 Improper URL validation when handling specific URLs Pub, Terraform and Docker packages might lead to SSRF vulnerability

Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog Artifactory, potentially exposing internal services and cached response data...

CVE-2026-65618

CVE-2026-65618 describes an SSRF risk in JFrog Artifactory due to improper URL validation when handling certain URLs. The vulnerability could allow an attacker to cause unauthorized requests from Artifactory, potentially exposing internal services and cached response data. Affected component is A...

OSEC-2026-13 ECDSA accepts the point at infinity as a P256, P384, P521 public key

P256,P384,P521.Dsa.pubofoctets accepts 0x00, the encoding of the point at infinity, as a public key. The Diffie-Hellman path rejects that point pointofoctets; the ECDSA path skips the same check. Under such a key a signature can be forged with no private key, as the repro shows. The same class is...

Exploit for Confused Deputy in Apache Camel

camel-dapr Consumer Routing-Header Override / Confused Deputy...

MAL-2026-6898 Malicious code in ts-relayer-pub (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a8ec05f673f1d04b65918474a638737320ac81126814fd8be765bbdc2bb5c1c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...