CVE-2026-105403

A security policy bypass vulnerability exists in ImageMagick versions before 6.9.13-56 and 7.x before 7.1.2-31 . The root cause is a flaw where policies using the coder domain, rather than the module domain, can be bypassed. An attacker can provide a crafted image to evade these restrictions, for...

Ivanti-Connect-Around-Scan

Ivanti Connect Around 취약점 검사기 Ivanti Connect Around 취약점 검사기 개요 기능 검사 유형 웹 접근 시스템 정보 우회 탐지됨 상태 유형 설명 시작하기 요구 사항 사용법 인수 대상 지정 사용자 정의 변수 출력 스타일링 할 일 기여 가이드라인 이슈 보고 풀 리퀘스트 제출 의도된 사용 및 면책 조항 목적 면책 조항 라이선스 감사의 말 저자 소개 개요 Connect Around 공격 체인CVE-2023-46805 및 CVE-2024-21887 관련은 Ivanti Connect Secure 및...

cve-2025-55182

cve-2025-55182 cve-2025-55182에 대한 테스트 및 보호를 위한 다양한 도구 모음입니다. 이 도구들은 보증 없이 제공되며, 사용자는 모든 위험을 감수합니다. 이는 공식 F5 Inc. 제품이 아닙니다. NIST에 연결된 POChttps://github.com/ejpir/CVE-2025-55182-research를 기반으로 합니다. NIST CVE 공개: https://nvd.nist.gov/vuln/detail/CVE-2025-55182 포함된 Postman Collection은 v2.1입니다. 알려진 취약한...

CVE-2026-103649

Missing network timeouts in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 allow a remote attacker to hold server threads indefinitely and so stop outbound mail delivery denial of service. The server set its socket timeouts in the form Windows takes, which Linux refuses, an...

CVE-2026-103649

Linux builds of Progressive Robot hMailServer versions 6.3.0 through 6.3.5 are vulnerable to a denial of service (DoS) due to missing network timeouts. The root cause is that the server sets socket timeouts in a Windows-specific format which Linux rejects, causing HTTPS clients to read without a ...

EUVD-2026-94835

Missing network timeouts in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 allow a remote attacker to hold server threads indefinitely and so stop outbound mail delivery denial of service. The server set its socket timeouts in the form Windows takes, which Linux refuses, an...

CVE-2026-103649 Synchronous Access of Remote Resource without Timeout in hMailServer

Missing network timeouts in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 allow a remote attacker to hold server threads indefinitely and so stop outbound mail delivery denial of service. The server set its socket timeouts in the form Windows takes, which Linux refuses, an...

CVE-2025-34291_cors_security_scanner

CVE-2025-34291corssecurityscanner CORSCross-Origin Resource Sharing 잘못된 구성 감지를 위한 경량 Python 기반 보안 평가 도구 - CVE-2025-34291. CORS 보안 스캐너 위험한 CORSCross-Origin Resource Sharing 잘못된 구성을 탐지하기 위한 경량 Python 기반 보안 평가 도구입니다. 이 도구는 다음을 식별하는 데 도움을 줍니다: - 와일드카드 CORS 정책 - 임의 출처 반영 - 인증 정보가 포함된 CORS 잘못된 구성 - 위험한...

CLEANSTART-2026-GR33077 Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service

CVE-2026-32281 affects multiple packages. Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. See references for individual vulnerability details...

CLEANSTART-2026-CD04274 Security fix for ghsa-hrxh-6v49-42gf applied in: aws-network-policy-agent 1.2.7-r0, fabric-peer 3.1.5-r1, gotenberg 8.33.0-r0, step 0.30.2-r4, kube-state-metrics-fips 2.20.0-r4, eks-distro-kube-apiserver 1.36.8-r0, eks-distro-kube-apiserver-fips 1.36.8-r0

ghsa-hrxh-6v49-42gf affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-KW79982 Security fix for ghsa-259r-337f-4rfw applied in: aws-network-policy-agent 1.1.6-r4, caddy 2.11.4-r1, fabric-peer 2.5.16-r2, fabric-peer 3.1.5-r1, gotenberg 8.33.0-r0, kubernetes-dns-node-cache 1.23.1-r2, step 0.30.2-r4

ghsa-259r-337f-4rfw affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

EUVD-2026-94648

Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names. This may allow an authenticated user with delegated permissions to bypass an explicit deny restriction and access a protected resource or assign a denied policy,...

EUVD-2026-94647

Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially crafted policy names to use the capabilities of policies defined in other namespaces, including the root namespace. This vulnerability...

PT-2026-107979

ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 allows a security policy bypass when a policy uses coder, rather than module, as its domain. An attacker can supply a crafted image to evade coder-based policy restrictions, causing ImageMagick to process formats the administrator intended to...

PT-2026-107985

ImageMagick before 6.9.13-55 and 7.x before 7.1.2-30 contains a security policy bypass in the MAT decoder, which does not enforce configured temporary file size limits when reading highly compressed data. Attackers can supply a crafted MAT image whose decompressed data is written to temporary fil...

PT-2026-107982

ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 lacks a security policy check in the CUT encoder, allowing configured security policies to be bypassed. Attackers can supply crafted input processed by the CUT encoder to crash the application or leak sensitive data...

Security Bulletin: Vault ACL Policy Evaluation May Allow Bypass of Deny Restrictions

Summary Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names. This may allow an authenticated user with delegated permissions to bypass an explicit deny restriction and access a protected resource or assign a denied policy,...

Security Bulletin: Vault ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution

Summary Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially crafted policy names to use the capabilities of policies defined in other namespaces, including the root namespace. This vulnerability...

CVE-2026-105820

Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially crafted policy names to use the capabilities of policies defined in other namespaces, including the root namespace. This vulnerability...

CVE-2026-89322

Vault and Vault Enterprise are vulnerable to a flaw where ACL policies are not consistently evaluated against the canonical form of resource and policy names. This CWE-178 (Improper Handling of Case Sensitivity) issue allows an authenticated user with delegated permissions to bypass explicit deny...