Important: Red Hat Security Advisory: cockpit-machines security update

An update for cockpit-machines is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabili...

CVE-2022-22978

CVE-2022-22978 Spring Security Pass Spring Security 成功 http://localhost:9090/login%0a Pass Spring Security with SayMyName 失敗 http://localhost:9090/name%0d Bypass Spring Security with Custom RBAC 失敗 http://localhost:9090/admin/admin%0d Bypass Spring Security with Annotation RBAC 失敗...

Important: Red Hat Security Advisory: cockpit-podman security update

An update for cockpit-podman is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

Important: Red Hat Security Advisory: cockpit-machines security, bug fix, and enhancement update

An update for cockpit-machines is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Important: Red Hat Security Advisory: subscription-manager-cockpit security update

An update for subscription-manager-cockpit is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...

CVE-2026-125113

The XRootD project provides a high-performance, fault-tolerant, and secure solution for handling large amounts of data distributed across multiple storage resources. Prior to version 5.9.2, XRootD's rpCheck function in src/XrdXrootd/XrdXrootdXeq.cc rejects a parent-directory component only when t...

CVE-2026-123797 SuperTokens Core: Unknown tenant path bypasses API key and public-tenant enforcement

SuperTokens Core is an open source authentication server. Prior to 11.3.6, 11.4.6, and 12.0.8, app-specific management requests using an unknown tenant path and an older supported cdi-version can bypass API-key and public-tenant enforcement. In...

CVE-2026-123797 SuperTokens Core: Unknown tenant path bypasses API key and public-tenant enforcement

SuperTokens Core is an open source authentication server. Prior to 11.3.6, 11.4.6, and 12.0.8, app-specific management requests using an unknown tenant path and an older supported cdi-version can bypass API-key and public-tenant enforcement. In...

Pods CVE-2026-19598 privilege escalation detect

CVE-2026-19598: meta-box-loader JSON path bypasses podsadmin guards; unauthenticated saveuser can reset user 1 password. !/usr/bin/env python3 -- coding: utf-8 -- """Pods = 3.3.9 unauthenticated podsadmin priv esc CVE-2026-19598.""" from future import annotations import secrets from kittysploit...

CVE-2026-125113: xrootd: The XRootD project provides a high-performance, fault-tolerant, and secure solution for handling large amounts of data…

The XRootD project provides a high-performance, fault-tolerant, and secure solution for handling large amounts of data distributed across multiple storage resources. Prior to version 5.9.2, XRootD's rpCheck function in src/XrdXrootd/XrdXrootdXeq.cc rejects a parent-directory component only when t...

cve-2023-20198-poc-cisco

CVE-2023-20198-poc CVE-2023-20198 is a critical vulnerability in the Cisco IOS XE software Web UI feature that allows unauthenticated remote attackers to create accounts with privilege level 15 on affected systems, thereby gaining full control of the device. The vulnerability primarily stems from...

Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes

Summary Since 4.6.0, Nuxt resolves . and .. segments in the request path, including percent-encoded forms such as %2e, before rendering a page. Nitro's routing, Nitro's route rules and server/middleware see the path with those segments still in place. A request for /%2e/admin therefore renders th...

GHSA-9V7C-Q64Q-VV33 Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes

Summary Since 4.6.0, Nuxt resolves . and .. segments in the request path, including percent-encoded forms such as %2e, before rendering a page. Nitro's routing, Nitro's route rules and server/middleware see the path with those segments still in place. A request for /%2e/admin therefore renders th...

CVE-2026-119200 Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes

Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, Nuxt resolves literal or percent-encoded dot segments before rendering a page while Nitro routing, server/middleware checks, and server route rules evaluate the unresolved path. A request such as /%2e/admin can...

CVE-2026-119200

The Nuxt web development framework versions 4.6.0 through 4.6.2 are vulnerable to a path traversal issue where literal or percent-encoded dot segments (e.g., /%2e/admin) are resolved before page rendering. This allows attackers to bypass Nitro routing , server/middleware path checks, and server r...

CVE-2026-119200 Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes

Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, Nuxt resolves literal or percent-encoded dot segments before rendering a page while Nitro routing, server/middleware checks, and server route rules evaluate the unresolved path. A request such as /%2e/admin can...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in starlette (CVE-2026-48710)

Summary An HTTP Host header path bypass vulnerability in the starlette package CVE-2026-48710 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 1.3.1 on both Linux and Windows operating systems in 11.7.0.15. Vulnerability Details...

GHSA-375P-5QHX-8WQ4 Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path

Summary When middleware.Static is mounted globally e.Usemiddleware.Static... and an application relies on a route- or group-level middleware guard to restrict a path that also falls under the served static root, a %2F-encoded request bypasses that guard while the file is still served. This is the...

CVE-2026-118650 Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path differently from Echo's router because the router matches the still-encoded path while the static handler uses the decoded URL.Path. The advisory demonstrates...

CVE-2026-118650 Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path differently from Echo's router because the router matches the still-encoded path while the static handler uses the decoded URL.Path. The advisory demonstrates...