640886 matches found
CVE-2026-71417
In Lemur before 1.9.3, a non-read-only user could upload a duplicate certificate row bypassing CertificatePermission, then revoke it via PUT /api/1/certificates//revoke, causing issuer plugins to revoke the real CA-side certificate and causing fleet-wide TLS denial of service. Fixed in 1.9.3. No ...
CVE-2026-71417 Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it
Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/certificates/upload allowed a non-read-only user to create a duplicate row using another certificate body, authorityid, serial, or externalid without requiring permission on the underlying authority. PUT /api/1/certificates//revo...
EUVD-2026-61159
Plainpad through 1.1.1, fixed in commit d3823fc, contains a missing rate limiting vulnerability that allows unauthenticated attackers to send unbounded login requests to the POST /v1/sessions endpoint due to dead code in App\Http\Kernel.php that is never instantiated under the Laravel 11+ skeleto...
CVE-2026-73529
Plainpad (≤1.1.1) has dead code in App\Http\Kernel.php under the Laravel 11+ skeleton, leaving the throttle config unattached to POST /v1/sessions, allowing unlimited unauthenticated credential attempts and CPU exhaustion via bcrypt comparisons. Fixed in commit d3823fc595b5d8f842a6fd7dfe49b7852a1...
CVE-2026-73529 Plainpad Missing Rate Limiting via POST /v1/sessions
Plainpad through 1.1.1, fixed in commit d3823fc, contains a missing rate limiting vulnerability that allows unauthenticated attackers to send unbounded login requests to the POST /v1/sessions endpoint due to dead code in App\Http\Kernel.php that is never instantiated under the Laravel 11+ skeleto...
CVE-2026-70666 Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs
Lemur manages TLS certificate creation. Prior to 1.9.3, an authority-role member could update acmeurl through PUT /api/1/authorities/ without revalidation and direct setupacmeclientnoretry to an attacker-controlled ACME server. ACME directory and order responses contain newNonce, newOrder,...
CVE-2026-70666
CVE-2026-70666 is a Server-Side Request Forgery (SSRF) in Lemur (Netflix's TLS certificate manager), rated CVSS 7.4 HIGH . Two defects combine: the acme_url allowlist is validated only at authority creation, not on the PUT /api/1/authorities/ update path, and the ACME client follows server-suppli...
CVE-2026-72274
A flaw was found in the Linux kernel's fbdev hecubafb module. A local attacker could exploit this by triggering an error path during the initialization of the hecubafb module. This could lead to a memory leak, potentially causing a denial of service due to resource exhaustion...
CVE-2026-72261
A flaw was found in the Linux kernel's Sound Open Firmware SOF subsystem, specifically within the ipc3-control component. This vulnerability occurs in the sndsofupdatecontrol function where the size of firmware-provided data is not properly validated against the allocated buffer size. An attacker...
CVE-2026-72258
A flaw was found in the Linux kernel's Advanced Linux Sound Architecture System on Chip ASoC Mediatek MT8183 audio driver. The Audio Front End AFE probe assigns reserved memory but does not release it when the driver is removed or if probe failures occur. This oversight can lead to a memory leak,...
CVE-2026-72256
A flaw was found in the Linux kernel. The xtcluster module, specifically within the xtclustermt function, incorrectly processes template connection tracking conntrack objects. This state confusion occurs when a template conntrack is attached before it is fully initialized, leading to xtclusterhas...
EUVD-2026-61110
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause improper input validation. A successful exploit might lead to denial of service...
CVE-2026-47629
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause improper input validation. A successful exploit might lead to denial of service...
CVE-2026-47629
Improper input validation in NVIDIA Triton Inference Server for Linux allows unauthenticated remote attackers to cause denial of service (CVSS 7.5 HIGH). No exploit details or patch version are provided; monitor NVIDIA's security advisory for updates.
CVE-2026-47629
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause improper input validation. A successful exploit might lead to denial of service...
CVE-2026-47628
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an allocation of resources without limits. A successful exploit might lead to denial of service...
EUVD-2026-61109
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an allocation of resources without limits. A successful exploit might lead to denial of service...
CVE-2026-47628
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an allocation of resources without limits. A successful exploit might lead to denial of service...
CVE-2026-47628
NVIDIA Triton Inference Server for Linux has an unbounded resource allocation flaw (CVSS 7.5, HIGH), exploitable over the network with no privileges, leading to denial of service. No patch version or exploit code is provided in the documents; no in-the-wild exploitation is reported.