GHSA-JRG3-GFJW-HM96 vulnerabilities

Vulnerabilities for packages: karpenter-fips, kubernetes-dashboard-auth-fips, cephcsi, memcached-exporter, helm-mapkubeapis, nsc-fips, flannel, kubevirt-cdi-apiserver-fips, grafana-mimir, wuzz, teleport-operator-fips, doppler-kubernetes-operator, request-1279, yace, aws-network-policy-agent-fips,...

CVE-2026-32280 vulnerabilities

Vulnerabilities for packages: karpenter-fips, kubernetes-dashboard-auth-fips, cephcsi, memcached-exporter, helm-mapkubeapis, nsc-fips, flannel, kubevirt-cdi-apiserver-fips, grafana-mimir, wuzz, teleport-operator-fips, doppler-kubernetes-operator, request-1279, yace, aws-network-policy-agent-fips,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: karpenter-fips, kubernetes-dashboard-auth-fips, cephcsi, memcached-exporter, helm-mapkubeapis, nsc-fips, flannel, kubevirt-cdi-apiserver-fips, grafana-mimir, wuzz, teleport-operator-fips, doppler-kubernetes-operator, request-1279, yace, aws-network-policy-agent-fips,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: karpenter-fips, kubernetes-dashboard-auth-fips, cephcsi, memcached-exporter, helm-mapkubeapis, nsc-fips, flannel, kubevirt-cdi-apiserver-fips, grafana-mimir, wuzz, teleport-operator-fips, doppler-kubernetes-operator, request-1279, yace, aws-network-policy-agent-fips,...

CVE-2026-39943

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus stores revision records in directusrevisions whenever items are created or updated. Due to the revision snapshot code not consistently calling the prepareDelta sanitization pipeline,...

CVE-2026-33781

An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine pfe of Juniper Networks Junos OS on specific EX and QFX Series devices allow an unauthenticated, adjacent attacker to cause a complete Denial of Service DoS. On EX4k, and QFX5k platforms configur...

CVE-2026-33781 Junos OS: EX Series, QFX Series: In a VXLAN scenario when specific control protocol packets are received, memory leaks and eventually no traffic is passed

An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine pfe of Juniper Networks Junos OS on specific EX and QFX Series devices allow an unauthenticated, adjacent attacker to cause a complete Denial of Service DoS. On EX4k, and QFX5k platforms configur...

CVE-2026-35461

Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, the Papra webhook system allows authenticated users to register arbitrary URLs as webhook endpoints with no validation of the destination address. The server makes outbound HTTP POST requests to registered URLs,...

GHSA-HFVC-G4FC-PQHX vulnerabilities

Vulnerabilities for packages: gcp-compute-persistent-disk-csi-driver, kubernetes-csi-node-driver-registrar, docker, vault-secrets-webhook, prometheus-alertmanager, trivy, step-ca, gitlab-pages, chartmuseum, rabbitmq-cluster-operator, spire-server, openfga, crossplane-provider-aws-kinesis,...

CVE-2026-39883 vulnerabilities

Vulnerabilities for packages: gcp-compute-persistent-disk-csi-driver, kubernetes-csi-node-driver-registrar, docker, vault-secrets-webhook, prometheus-alertmanager, trivy, step-ca, gitlab-pages, chartmuseum, rabbitmq-cluster-operator, spire-server, openfga, crossplane-provider-aws-kinesis,...

CVE-2026-39883 vulnerabilities

Vulnerabilities for packages: gogatekeeper, terragrunt, melange, fulcio, grype-fips, grafana-mimir, teleport-operator-fips, skaffold, crossplane-provider-aws-osis, consul, crossplane-function-patch-and-transform, kuberay-apiserver-fips, temporal, rancher-support-bundle-kit, amazon-cloudwatch-agen...

GHSA-HFVC-G4FC-PQHX vulnerabilities

Vulnerabilities for packages: gogatekeeper, terragrunt, melange, fulcio, grype-fips, grafana-mimir, teleport-operator-fips, skaffold, crossplane-provider-aws-osis, consul, crossplane-function-patch-and-transform, kuberay-apiserver-fips, temporal, rancher-support-bundle-kit, amazon-cloudwatch-agen...

Windows Telemetry Persistence

This is a Metasploit module that provides a persistence mechanism that installs a new telemetry provider for windows. If telemetry is turned on, when the scheduled task launches, it will execute the telemetry provider and execute our payload with system permissions...

CVE-2026-39411

CVE-2026-39411 (LobeHub) describes an unauthenticated authentication bypass on the webapi routes via a forgeable, client-controlled X-lobe-chat-auth header. Before version 2.1.48, the webapi authentication layer trusts an XOR-obfuscated header (hardcoded key: “LobeHub · LobeHub”) and treats decod...

CVE-2026-39411 LobeHub has an unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header

LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you. Prior to 2.1.48, the webapi authentication layer trusts a client-controlled X-lobe-chat-auth header that is only XOR-obfuscated, not signed or otherwise authenticated. Because the XOR ke...

CVE-2026-5465

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.3. This is due to the UpdateProviderCommandHandler failing to validate changes to the externalId field when a Provider Employe...

CVE-2026-34719

CVE-2026-34719 affects Zammad. The vulnerability is a server-side request forgery (SSRF) in the webhook model. Before 7.0.1 and 6.5.4, the webhook validation only checked the URL scheme and hostname, missing proper validation for loopback and link-local addresses, enabling potential access to con...

GHSA-5MWJ-V5JW-5C97 LobeHub: Unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header

Summary The webapi authentication layer trusts a client-controlled X-lobe-chat-auth header that is only XOR-obfuscated, not signed or otherwise authenticated. Because the XOR key is hardcoded in the repository, an attacker can forge arbitrary auth payloads and bypass authentication on protected...

LobeHub: Unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header

Summary The webapi authentication layer trusts a client-controlled X-lobe-chat-auth header that is only XOR-obfuscated, not signed or otherwise authenticated. Because the XOR key is hardcoded in the repository, an attacker can forge arbitrary auth payloads and bypass authentication on protected...

Security Bulletin: Security vulnerabilities have been found in IBM Verify Identity Access OIDC Provider

Summary Security vulnerabilities have been addressed in IBM Verify Identity Access OIDC Provider Vulnerability Details CVEID:CVE-2026-24051 DESCRIPTION: OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking...