opencode

The open source AI coding agent. English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dansk | 日本語 | Polski | Русский | Bosanski | العربية | Norsk | Português Brasil | ไทย | Türkçe | Українська | বাংলা | Ελληνικά | Tiếng Việt Installation YOLO curl -fsSL...

tko-subs

tko-subs Esta herramienta permite: Verificar si un subdominio puede ser tomado porque tiene: un CNAME colgante que apunta a un proveedor de CMS Heroku, Github, Shopify, Amazon S3, Amazon CloudFront, etc. que puede ser tomado. un CNAME colgante que apunta a un nombre de dominio inexistente uno o m...

jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update

jackson-core 2.21.6-1 - Rebase to version 2.21.6 - Resolves: RHEL-259227 jackson-databind 2.21.6-1 - Rebase to version 2.21.6 - Resolves: RHEL-259227 jackson-jaxrs-providers 2.21.6-1 - Rebase to version 2.21.6 - Resolves: RHEL-259227 jackson-modules-base 2.21.6-1 - Rebase to version 2.21.6 -...

CVE-2026-108581

TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileged users to read stored provider API keys via GET /api/providers and GET /api/voice/providers. Attackers can query these endpoints, which only validate the JWT, to obtain...

CVE-2026-108581

TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileged users to read stored provider API keys via GET /api/providers and GET /api/voice/providers. Attackers can query these endpoints, which only validate the JWT, to obtain...

EUVD-2026-96364

TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileged users to read stored provider API keys via GET /api/providers and GET /api/voice/providers. Attackers can query these endpoints, which only validate the JWT, to obtain...

CVE-2026-108581 Octop through 1.0.2b6 Missing Authorization Exposes Provider API Keys via /api/providers

TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileged users to read stored provider API keys via GET /api/providers and GET /api/voice/providers. Attackers can query these endpoints, which only validate the JWT, to obtain...

CVE-2026-108581 Octop through 1.0.2b6 Missing Authorization Exposes Provider API Keys via /api/providers

TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileged users to read stored provider API keys via GET /api/providers and GET /api/voice/providers. Attackers can query these endpoints, which only validate the JWT, to obtain...

CVE-2026-108581

TencentCloud Octop versions through 1.0.2b6 are vulnerable to a missing authorization flaw (CWE-862). Authenticated users with low privileges can access the GET /api/providers and GET /api/voice/providers endpoints, which only validate the JWT without sufficient permission checks. This allows att...

CVE-2026-108581: Missing Authorization

TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileged users to read stored provider API keys via GET /api/providers and GET /api/voice/providers. Attackers can query these endpoints, which only validate the JWT, to obtain...

CVE-2026-106493

Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalog providers did not sufficiently validate object paths. A principal able to create or rename objects in a configured Azure Blob Storage or AWS S3 catalog source could cause catalog descriptors to b...

apache-airflow-providers-snowflake (>=2.4.0rc1, <=2.5.1), rcd-dev-kit (>=0.0.11, <=1.1.0) potentially affected by CVE-2026-86597 via snowflake-connector-python (2.7.1)

snowflake-connector-python PYPI version 2.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - apache-airflow-providers-snowflake =2.4.0rc1, =0.0.11, =1.1.0 Source cves: CVE-2026-86597 Source advisory:...

CVE-2026-63270 Environment/ini-file leaks

URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not cover every place a document can supply a URL...

PT-2026-104817

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Opening a document containing specially crafted links allows the construction of URLs that expand environment variable or INI file values. This can lead to the...

CVE-2026-63270: Exposure of Sensitive Information to an Unauthorized Actor

URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not cover every place a document can supply a URL...

[SECURITY] Fedora 45 Update: mobile-broadband-provider-info-20240407-7.fc45

The mobile-broadband-provider-info package contains listings of mobile broadband 3G providers and associated network and plan information...

EUVD-2026-91792

UTMStack before 11.2.16 contains a server-side request forgery vulnerability in IdentityProviderService.validateMetadataUrl that allows authenticated attackers to make the server send requests to arbitrary internal or cloud metadata hosts by supplying a malicious metadata URL to the...

CVE-2026-82040 UTMStack < 11.2.16 SSRF via IdentityProviderService

UTMStack before 11.2.16 contains a server-side request forgery vulnerability in IdentityProviderService.validateMetadataUrl that allows authenticated attackers to make the server send requests to arbitrary internal or cloud metadata hosts by supplying a malicious metadata URL to the...

CVE-2026-82040 UTMStack < 11.2.16 SSRF via IdentityProviderService

UTMStack before 11.2.16 contains a server-side request forgery vulnerability in IdentityProviderService.validateMetadataUrl that allows authenticated attackers to make the server send requests to arbitrary internal or cloud metadata hosts by supplying a malicious metadata URL to the...

CVE-2026-82040 UTMStack < 11.2.16 SSRF via IdentityProviderService

UTMStack before 11.2.16 contains a server-side request forgery vulnerability in IdentityProviderService.validateMetadataUrl that allows authenticated attackers to make the server send requests to arbitrary internal or cloud metadata hosts by supplying a malicious metadata URL to the...