CVE-2026-71277 rust-iot-platform Authentication Bypass via Non-Validated Authorization Header

rust-iot-platform's AuthToken request-guard implementation api/src/main.rs only checks whether the Authorization HTTP header is present, and never validates its value against any session, token store, or signature. Any request carrying an arbitrary non-empty Authorization header e.g. satisfies th...

CVE-2026-71277

rust-iot-platform's AuthToken request-guard implementation api/src/main.rs only checks whether the Authorization HTTP header is present, and never validates its value against any session, token store, or signature. Any request carrying an arbitrary non-empty Authorization header e.g. satisfies th...

CVE-2026-71277

Affected software: rust-iot-platform, specifically the AuthToken request-guard in api/src/main.rs. Vulnerability: the guard only checks for the presence of the Authorization header, with no validation against sessions, token stores, or signatures. Any non-empty header (e.g., Authorization: fake) ...

bramble v1.14.1-chromium

Bramble A password manager that keeps your secrets on your own devices. No account, no server holding your vault, no company to get breached and leak everything. You hold the vault, you hold the password, and that's it. Bramble runs where you do: Browser extension for Chromium browsers Brave,...

openvas-scanner v23.50.12

OpenVAS Scanner This is the OpenVAS Scanner of the Greenbone Community Edition. It is used for the Greenbone Enterprise appliances and is a full-featured scan engine that executes a continuously updated and extended feed of Vulnerability Tests VTs. Releases All release files are signed with the...

CVE-2026-70378 imagecli - Negative carve Ratio Bypasses Bounds Check and Crashes Process via Reachable Panic

imagecli's pipeline operation Carve::apply in src/imageops.rs only asserts , never validating that the ratio is positive. A negative ratio e.g. -5 causes the computed target width to saturate to 0 via Rust's defined float-to-uint cast, which is then passed to imageproc::seamcarving::shrinkwidth —...

nah v1.2.0

expensive mistakes stop here microsecond verdicts. no LLM. extensible. nahguard.ai • what it blocks • how it decides • install • extend • threat model root@kitploit: curl -fsSL nahguard.ai/install | sh claude code · codex · cursor · pi · + 10 more nah is a guard that sits in your coding agent's...

hermes-decomp v0.2.1

Rust decompiler for Hermes bytecode .hbc, the JS engine behind React Native. Supports HBC 40 to 99. Install Pre-built binaries Linux / macOS / Windows from Releases or Actions: Asset suffix| Platform ---|--- linux-x8664 / linux-arm64| Linux macos-arm64 / macos-x8664| macOS windows-x8664| Windows...

PT-2026-68150

Name of the Vulnerable Software and Affected Versions rust-iot-platform affected versions not specified Description The AuthToken request-guard implementation in api/src/main.rs fails to validate the value of the Authorization HTTP header against a session, token store, or signature. It only...

PT-2026-68151

Name of the Vulnerable Software and Affected Versions rust-iot-platform affected versions not specified Description An unauthenticated attacker can achieve arbitrary JavaScript execution in the server process by creating and triggering a malicious calc rule. The endpoint 'POST /calc-rule/create'...

Fedora 45 : rust-crypto-auditing / rust-crypto-auditing-agent / etc (2026-160ff29e13)

The remote Fedora 45 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-160ff29e13 advisory. Update to 0.3.2 release with security fixes in dependencies: - RUSTSEC-2026-0007 - RUSTSEC-2026-0009 Tenable has extracted the preceding description block...

CVE-2026-71277: Improper Authentication

rust-iot-platform's AuthToken request-guard implementation api/src/main.rs only checks whether the Authorization HTTP header is present, and never validates its value against any session, token store, or signature. Any request carrying an arbitrary non-empty Authorization header e.g. satisfies th...

CVE-2026-71278: Improper Control of Generation of Code

rust-iot-platform allows creating a "calc rule" via POST /calc-rule/create api/src/controller/calcrulerouter.rs containing an arbitrary field. This route does not take the AuthToken request guard used elsewhere in the application, making it reachable without authentication...

Photon OS 5.0: Rust PHSA-2023-5.0-91-0067

An update of the rust package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-91-0067. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

openvas-scanner v23.50.11

OpenVAS Scanner This is the OpenVAS Scanner of the Greenbone Community Edition. It is used for the Greenbone Enterprise appliances and is a full-featured scan engine that executes a continuously updated and extended feed of Vulnerability Tests VTs. Releases All release files are signed with the...

CVE-2026-47618

NVIDIA Dynamo for Linux contains a vulnerability in the Rust multimodal media fetcher where an attacker could cause server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure...

CVE-2026-47618

NVIDIA Dynamo for Linux contains a vulnerability in the Rust multimodal media fetcher where an attacker could cause server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure...

EUVD-2026-52813

NVIDIA Dynamo for Linux contains a vulnerability in the Rust multimodal media fetcher where an attacker could cause server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure...

CVE-2026-47618

NVIDIA Dynamo for Linux contains a vulnerability in the Rust multimodal media fetcher where an attacker could cause server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure...

CVE-2026-47618

CVE-2026-47618 affects NVIDIA Dynamo for Linux, specifically the Rust multimodal media fetcher. The vulnerability enables server-side request forgery (SSRF) that could lead to information disclosure. The NVIDIA bulletin lists affected versions (0 to v1.1.0) updated to v1.1.1, with additional fixe...