2807 matches found
CVE-2026-53525
WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison functions weechatstrcasecmp and strcmp to verify password hashes and plaintext passwords. An attacker can exploit timing...
CVE-2026-53525 WeeChat has Non-Constant-Time Password Hash Comparison in Relay Authentication
WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison functions weechatstrcasecmp and strcmp to verify password hashes and plaintext passwords. An attacker can exploit timing...
EUVD-2026-64186
WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison functions weechatstrcasecmp and strcmp to verify password hashes and plaintext passwords. An attacker can exploit timing...
CVE-2026-53525
WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison functions weechatstrcasecmp and strcmp to verify password hashes and plaintext passwords. An attacker can exploit timing...
CVE-2026-53525 WeeChat has Non-Constant-Time Password Hash Comparison in Relay Authentication
WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison functions weechatstrcasecmp and strcmp to verify password hashes and plaintext passwords. An attacker can exploit timing...
CVE-2026-53525
WeeChat (a free chat client) versions 0.3.1 through 4.9.0 are affected by a timing side-channel in relay authentication. The relay uses non-constant-time string comparison functions (weechat_strcasecmp and strcmp ) to verify password hashes and plaintext passwords. An attacker can exploit timing ...
CVE-2026-53524 WeeChat has a Decompression Bomb in Relay WebSocket (DoS)
WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 4.3.0 through 4.9.0, the WeeChat relay module's WebSocket permessage-deflate decompression function relaywebsocketinflate has no upper bound on output size. An authenticated relay user can send a small compressed WebSock...
EUVD-2026-64185
WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 4.3.0 through 4.9.0, the WeeChat relay module's WebSocket permessage-deflate decompression function relaywebsocketinflate has no upper bound on output size. An authenticated relay user can send a small compressed WebSock...
CVE-2026-53524 WeeChat has a Decompression Bomb in Relay WebSocket (DoS)
WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 4.3.0 through 4.9.0, the WeeChat relay module's WebSocket permessage-deflate decompression function relaywebsocketinflate has no upper bound on output size. An authenticated relay user can send a small compressed WebSock...
CVE-2026-53524
WeeChat versions 4.3.0 through 4.9.0 contain a decompression bomb vulnerability in the relay module's WebSocket permessage-deflate decompression function (relay_websocket_inflate()). The function imposes no upper bound on output size, allowing an authenticated relay user to send a small compresse...
CVE-2026-53524
WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 4.3.0 through 4.9.0, the WeeChat relay module's WebSocket permessage-deflate decompression function relaywebsocketinflate has no upper bound on output size. An authenticated relay user can send a small compressed WebSock...
CVE-2026-15576
Improper authentication in the agent receiver of Checkmk 2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client certificate verification of relay endpoints by supplying a fixed placeholder identity in the request URL, resulting in limited impact on integrity and...
CVE-2026-15576 Agent receiver accepts mTLS requests without a client certificate
Improper authentication in the agent receiver of Checkmk 2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client certificate verification of relay endpoints by supplying a fixed placeholder identity in the request URL, resulting in limited impact on integrity and...
CVE-2026-15576
CVE-2026-15576 is an improper authentication vulnerability in the agent receiver of Checkmk versions prior to 2.5.0p10 . An unauthenticated remote attacker can bypass mutual TLS (mTLS) client certificate verification on relay endpoints by supplying a fixed placeholder identity in the request URL....
EUVD-2026-63903
Improper authentication in the agent receiver of Checkmk 2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client certificate verification of relay endpoints by supplying a fixed placeholder identity in the request URL, resulting in limited impact on integrity and...
DEBIAN-CVE-2026-77641
tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUXSWITCH cell fails. The return value of relaysendcommandfromedge was ignored, so a send failure which calls circuitmarkforclose and removes the leg via cfxdelleg would go undetected, causing the caller to write to the...
PT-2026-79151
tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX SWITCH cell fails. The return value of relay send command from edge was ignored, so a send failure which calls circuit mark for close and removes the leg via cfx del leg would go undetected, causing the caller to write...
CVE-2026-19875
IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to overwrite administrator email information and abuse the server as an outbound relay due to missing authentication for the registration endpoint...
CVE-2026-19875
IBM Langflow OSS versions 1.0.0 through 1.10.0 contain an authentication bypass in the POST /api/v2/registration/ endpoint (CWE-306). An unauthenticated remote attacker can overwrite the server's registered admin email address and trigger outbound telemetry calls, enabling the instance to be abus...
CVE-2026-19875 Unauthenticated Registration POST Endpoint Permits Admin Email Overwrite and Outbound Relay Abuse in Langflow
IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to overwrite administrator email information and abuse the server as an outbound relay due to missing authentication for the registration endpoint...