2430 matches found
CVE-2026-23522
LobeChat is an open source chat application platform. Prior to version 2.0.0-next.193, knowledgeBase.removeFilesFromKnowledgeBase tRPC ep allows authenticated users to delete files from any knowledge base without verifying ownership. userId filter in the database query is commented out, so it's...
MiracleLinux 8 : samba-4.14.5-7.el8 (AXSA:2022-2911:01)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2022-2911:01 advisory. samba: Active Directory AD domain user could become root on domain members CVE-2020-25717 samba: SMB1 client connections can be downgraded to...
EUVD-2026-2923
RustFS is a distributed object storage system built in Rust. From = 1.0.0-alpha.1 to 1.0.0-alpha.79, invalid RPC signatures cause the server to log the shared HMAC secret and expected signature, which exposes the secret to log readers and enables forged RPC calls. In...
CVE-2026-22782 RustFS RPC signature verification logs shared secret
RustFS is a distributed object storage system built in Rust. From = 1.0.0-alpha.1 to 1.0.0-alpha.79, invalid RPC signatures cause the server to log the shared HMAC secret and expected signature, which exposes the secret to log readers and enables forged RPC calls. In...
CVE-2026-22782 RustFS RPC signature verification logs shared secret
RustFS is a distributed object storage system built in Rust. From = 1.0.0-alpha.1 to 1.0.0-alpha.79, invalid RPC signatures cause the server to log the shared HMAC secret and expected signature, which exposes the secret to log readers and enables forged RPC calls. In...
EUVD-2026-3090
Malicious code in vuefrontendrpc npm...
Rustfs log information leakage vulnerability
RustFS is a high-performance object storage system developed by RustFS. Versions 1.0.0-alpha.1 to 1.0.0-alpha.79 of RustFS contain a vulnerability related to log information leakage. This vulnerability arises from invalid RPC signatures, which allow the server to record shared HMAC keys,...
KB5074109: Windows 11 Version 24H2 / Windows 11 Version 25H2 / Windows 2025 Security Update (January 2026)
The remote Windows host is missing security update 5074109. It is, therefore, affected by multiple vulnerabilities - Use after free in Windows Local Security Authority Subsystem Service LSASS allows an authorized attacker to execute code over a network. CVE-2026-20854 - An issue was discovered in...
Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003845)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003845 advisory. gssmechfree in net/sunrpc/authgss/gssmechswitch.c in the rpcsecgsskrb5 implementation in the Linux kernel through 5.6.10 lacks certain domainrelease calls, leading t...
MiracleLinux 7 : rpcbind-0.2.0-38.0.1.el7.AXS7 (AXSA:2017-1656:01)
The remote MiracleLinux 7 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2017-1656:01 advisory. The rpcbind utility is a server that converts RPC program numbers into universal addresses. It must be running on the host to be able to make RPC calls on a...
Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003266)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003266 advisory. The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel through 4.10.11 allows remote attackers to cause a denial of service system crash via a long RPC...
CVE-2026-20821
Exposure of sensitive information to an unauthorized actor in Windows Remote Procedure Call allows an unauthorized attacker to disclose information locally...
CVE-2026-20832
Windows Remote Procedure Call Interface Definition Language IDL Elevation of Privilege Vulnerability...
AZL-74628 CVE-2025-71120 affecting package kernel for versions less than 6.6.121.1-1
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauthgss: avoid NULL deref on zero length gsstoken in gssreadproxyverf A zero length gsstoken results in pages == 0 and intoken-pages0 is NULL. The code unconditionally evaluates pageaddressintoken-pages0 for the initia...
MiracleLinux 3 : samba-3.0.33-3.39.0.1.AXS3 (AXSA:2012-537:02)
The remote MiracleLinux 3 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2012-537:02 advisory. Samba is the suite of programs by which a lot of PC-related machines share files, printers, and other information such as lists of available files and printer...
MiracleLinux 3 : krb5-1.6.1-17AXS3.1 (AXSA:2008-153:02)
The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2008-153:02 advisory. Kerberos V5 is a trusted-third-party network authentication system, which can improve your network's security by eliminating the insecure practice of...
MiracleLinux 4 : samba-3.5.10-115.AXS4 (AXSA:2012-512:02)
The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2012-512:02 advisory. Samba is the suite of programs by which a lot of PC-related machines share files, printers, and other information such as lists of available files and printer...
openc3-api Vulnerable to Unauthenticated Remote Code Execution
Summary OpenC3 COSMOS contains a critical remote code execution vulnerability reachable through the JSON-RPC API. When a JSON-RPC request uses the string form of certain APIs, attacker-controlled parameter text is parsed into values using Stringconverttovalue. For array-like inputs, converttovalu...
CVE-2025-68271 Unauthenticated Remote Code Execution in openc3-api
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.0 to 6.10.1, OpenC3 COSMOS contains a critical remote code execution vulnerability reachable through the JSON-RPC API. When a JSON-RPC request uses the string form of...