40 matches found
CVE-2026-55775 OpenBao's System Backend allows Unauthorized Management of the containing Namespace
OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao users granted capabilities on /sys/namespaces/root within a non-root namespace could exploit special handling of the literal root path in namespace canonicalization. The /sys/namespaces/ endpoint family ca...
CVE-2026-55775 OpenBao's System Backend allows Unauthorized Management of the containing Namespace
OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao users granted capabilities on /sys/namespaces/root within a non-root namespace could exploit special handling of the literal root path in namespace canonicalization. The /sys/namespaces/ endpoint family ca...
CVE-2026-55775 OpenBao's System Backend allows Unauthorized Management of the containing Namespace
OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao users granted capabilities on /sys/namespaces/root within a non-root namespace could exploit special handling of the literal root path in namespace canonicalization. The /sys/namespaces/ endpoint family ca...
GO-2026-5517 OpenBao's System Backend allows Unauthorized Management of the containing Namespace in github.com/openbao/openbao
OpenBao's System Backend allows Unauthorized Management of the containing Namespace in github.com/openbao/openbao...
GHSA-MWR2-WMGP-CRJ6 OpenBao's System Backend allows Unauthorized Management of the containing Namespace
Summary A user that is granted namespace management /sys/namespaces capabilities within a non-root namespace "the victim namespace" can abuse special handling of the literal path "root" in namespace path canonicalization to manage the victim namespace itself. Details Several endpoints under...
EUVD-2026-13796
Calling gethostbyaddr or gethostbyaddrr with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the...
CVE-2026-33054
Mesop is a Python-based UI framework that allows users to build web applications. Versions 1.2.2 and below contain a Path Traversal vulnerability that allows any user supplying an untrusted statetoken through the UI stream payload to arbitrarily target files on the disk under the standard...
Security update for glibc
This update for glibc fixes the following issues: CVE-2026-0915: resolv: Fix NSS DNS backend for getnetbyaddr bsc1256822, BZ 33802 CVE-2025-15281: posix: Reset wordexpt fields with WRDEREUSE bsc1257005, BZ 33814 CVE-2025-8058: posix: Fix double-free after allocation failure in regcomp bsc1246965,...
CVE-2024-38970
vaeThink 1.0.2 is vulnerable to Information Disclosure via the system backend,access management administrator function...
CVE-2024-48176
Lylme Spage version v1.9.5 is vulnerable to Incorrect Access Control due to a lack of limits on login attempts and a verification code that does not refresh after a failed login. This allows an attacker to perform a brute-force
CVE-2024-48176
Lylme Spage v1.9.5 is vulnerable to Incorrect Access Control. There is no limit on the number of login attempts, and the verification code will not be refreshed after a failed login, which allows attackers to blast the username and password and log into the system backend...
CVE-2024-48176
Lylme Spage v1.9.5 is vulnerable to Incorrect Access Control. There is no limit on the number of login attempts, and the verification code will not be refreshed after a failed login, which allows attackers to blast the username and password and log into the system backend...
CVE-2024-48176
Lylme Spage v1.9.5 is vulnerable to Incorrect Access Control. There is no limit on the number of login attempts, and the verification code will not be refreshed after a failed login, which allows attackers to blast the username and password and log into the system backend...
CVE-2024-38970
vaeThink 1.0.2 is vulnerable to Information Disclosure via the system backend,access management administrator function...
CVE-2024-38970
vaeThink 1.0.2 is vulnerable to Information Disclosure via the system backend,access management administrator function...
CVE-2024-38971: Improper Neutralization of Input During Web Page Generation
vaeThink 1.0.2 is vulnerable to stored Cross Site Scripting XSS in the system backend...
CVE-2024-38971
vaeThink 1.0.2 is vulnerable to stored Cross Site Scripting XSS in the system backend...
CVE-2024-38970
vaeThink 1.0.2 is vulnerable to Information Disclosure via the system backend,access management administrator function...
CVE-2024-38971
CVE-2024-38971 affects vaeThink 1.0.2 and is a stored XSS vulnerability in the system backend. Multiple sources (Red Hat, NVD, OSV, CNNVD, CVE lists) confirm the issue; exploitation details are not provided in the documents. Some connected sources (PT-Security) advise temporarily disabling the ba...