PT-2026-110785

Name of the Vulnerable Software and Affected Versions ZITADEL versions 4.x through 4.19.1 ZITADEL versions 3.x through 3.4.15 Description An authentication bypass exists in the SAML identity-provider intent callback. The system verifies the assertion signature using the provider specified in the...

EulerOS 2.0 SP11 : sssd (EulerOS-SA-2026-4382)

According to the versions of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP...

EulerOS 2.0 SP11 : sssd (EulerOS-SA-2026-4292)

According to the versions of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP...

EulerOS 2.0 SP13 : sssd (EulerOS-SA-2026-4110)

According to the versions of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A path traversal flaw was found in SSSD's AD GPO provider. The adgpoextractsmbcomponents function does not sanitize .. sequences in the gPCFileSysPa...

Apache YuniKorn 1.9.0 LDAP Group Provider Denial of Service

Apache YuniKorn versions 1.8.0 and 1.9.0 contain an LDAP group provider denial of service vulnerability that causes a resolver panic when a memberOf attribute lacks "CN=". !/usr/bin/env bash Apache YuniKorn 1.9.0 LDAP Group Provider Panic Denial of Service Vendor: The Apache Software Foundation...

CVE-2026-109372: Improper Authentication

ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the assertion signature using the provider named in the request URL but resolves the user from the login intent without checking they match. Attackers...

phpBB-CVE-2026-48611

USE AT YOUR OWN RISK. This tool is provided strictly for authorized security research, penetration testing, and educational purposes. Only run it against systems you own or have explicit, written permission to test. The author is not responsible or liable for any illegal or unethical use of this...

reproxy

Reproxy es un servidor/proxy inverso simple de borde HTTPs que admite varios proveedores docker, estático, archivo, catálogo consul. Uno o más proveedores suministran información sobre el servidor solicitado, la URL solicitada, la URL de destino y la URL de verificación de salud. Se distribuye co...

Root-My-Galaxy-S938B

Root My Galaxy — S938B Root My Galaxy is a firmware-profiled installer for temporary KernelSU root on supported Samsung builds. This fork is maintained for the Galaxy S25 Ultra SM-S938B running: Build: BP4A.251205.006.S938BXXSBCZG3 Kernel: 6.6.98-android15-8-pd6ff1cd-abogkiS938BXXSBCZG3-4k Downlo...

CVE-2026-108863 Katanemo Plano through 0.4.37 Missing Authentication on Envoy Admin Interface

Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attackers to access the Envoy admin interface, which is bound to all host interfaces on port 9901. Attackers can request the /configdump endpoint to read configured LLM provider API...

EUVD-2026-97014

Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attackers to access the Envoy admin interface, which is bound to all host interfaces on port 9901. Attackers can request the /configdump endpoint to read configured LLM provider API...

CVE-2026-108760 LlamaFarm through 0.0.34 Unauthenticated API Exposed on All Interfaces

LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port 14345, while the lf CLI silently discards HOST overrides. Network-adjacent attackers can call the project and dataset management API to read stored provider API key...

CVE-2026-108760

LlamaFarm versions through 0.0.34 are vulnerable to an unauthenticated API exposure due to an insecure default configuration. The software binds its FastAPI server to 0.0.0.0 on port 14345 , while the lf CLI silently ignores HOST overrides . This allows network-adjacent attackers to access the pr...

CVE-2026-108863: Missing Authentication for Critical Function

Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attackers to access the Envoy admin interface, which is bound to all host interfaces on port 9901. Attackers can request the /configdump endpoint to read configured LLM provider API...

PT-2026-110182

🚨 CVE-2026-108863 Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attackers to access the Envoy admin interface, which is bound to all host interfaces on port 9901. Attackers can request the /config dump endpoint to read configured...

authentik

What is authentik? authentik is an open-source Identity Provider IdP for modern SSO. It supports SAML, OAuth2/OIDC, LDAP, RADIUS, and more, designed for self-hosting from small labs to large production clusters. Our enterprise offering is available for organizations to securely replace existing...

CVE-2026-108581

TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileged users to read stored provider API keys via GET /api/providers and GET /api/voice/providers. Attackers can query these endpoints, which only validate the JWT, to obtain...

CVE-2026-108581 Octop through 1.0.2b6 Missing Authorization Exposes Provider API Keys via /api/providers

TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileged users to read stored provider API keys via GET /api/providers and GET /api/voice/providers. Attackers can query these endpoints, which only validate the JWT, to obtain...

CVE-2026-108581

TencentCloud Octop versions through 1.0.2b6 are vulnerable to a missing authorization flaw (CWE-862). Authenticated users with low privileges can access the GET /api/providers and GET /api/voice/providers endpoints, which only validate the JWT without sufficient permission checks. This allows att...

GHSA-WPFX-QCH4-Q5J2 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws-fips, cluster-autoscaler, envoy-ai-gateway, crossplane-provider-aws-efs-fips, falcoctl-fips, kube-rbac-proxy, temporal-ui-server-fips, extension-auto-registration-kubernetes, spire-controller-manager-fips, versitygw-fips, request-1279, conftest,...