Lucene search
+L

13760 matches found

Github Security Blog
Github Security Blog
•added 2026/09/10 10:46 p.m.•15 views

rclone: FTP cross-session auth-proxy backend confusion

Summary The FTP auth-proxy driver stores one obscured password per username in a server-wide map. It does not bind the credential or returned VFS to the authenticated FTP session. If two accepted credentials use the same username but resolve to different proxy backends, the later login overwrites...

7.3CVSS5.8AI score0.00425EPSS
SaveExploits0References5Affected Software1
CVE
CVE
•added 2026/09/10 6:07 p.m.•21 views

CVE-2026-88035

CVE-2026-88035 is a heap buffer overflow in the MongoDB C Driver 's client-side authentication path, triggered during SASL username canonicalization . A size-check integer wrap-around allows an unusually large username to be copied past the end of a small buffer, causing the embedding application...

5.7CVSS5.8AI score0.00103EPSS
SaveExploits0References1Affected Software1
Cvelist
Cvelist
•added 2026/09/10 6:07 p.m.•41 views

CVE-2026-88035 Heap buffer overflow via wrapped size check during SASL username canonicalization in MongoDB C Driver

A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the application that embeds the driver to...

5.7CVSS0.00103EPSS
SaveExploits0References1
MongoDB
MongoDB
•added 2026/09/10 6:07 p.m.•11 views

Heap buffer overflow via wrapped size check during SASL username canonicalization in MongoDB C Driver

A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the application that embeds the driver to...

5.7CVSS5.8AI score0.00103EPSS
SaveExploits0References1Affected Software1
OSV
OSV
•added 2026/09/10 2:48 p.m.•8 views

GO-2026-6424 SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to anonymous readers in github.com/siyuan-note/siyuan/kernel

SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to anonymous readers in github.com/siyuan-note/siyuan/kernel...

9.2CVSS5.7AI score0.00409EPSS
SaveExploits0References4
OSV
OSV
•added 2026/09/10 2:48 p.m.•7 views

GO-2026-6398 SiYuan: Absolute filesystem path and OS username disclosure via resolveAssetPath in github.com/siyuan-note/siyuan/kernel

SiYuan: Absolute filesystem path and OS username disclosure via resolveAssetPath in github.com/siyuan-note/siyuan/kernel...

6.9CVSS5.7AI score0.00325EPSS
SaveExploits0References4
OSV
OSV
•added 2026/09/10 9:45 a.m.•7 views

PYSEC-2026-3937 vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages

Summary When the vLLM API receives a malformed request e.g., invalid JSON or missing required fields, FastAPI raises a Pydantic RequestValidationError. The validationexceptionhandler in vllm/entrypoints/openai/serverutils.py converts this exception to a string via strexc, which includes the...

5.3CVSS5.8AI score0.00419EPSS
SaveExploits0References8
OSV
OSV
•added 2026/09/10 9:44 a.m.•7 views

PYSEC-2026-3809 asyncssh has an incomplete fix for CVE-2026-45309 — AuthorizedKeysFile %u still escapes the intended directory via a leading ~ (and weakly via ${ENV}) username substitution

Incomplete fix for CVE-2026-45309 GHSA-g794-3fmp-753h. The 2.23.0 guard that sanitises the SSH username before %u substitution in AuthorizedKeysFile blocks /, \ and .., but does not block a leading or $ENV, both of which are re-introduced by later expansion and reach the file open — defeating the...

5.9CVSS6AI score0.00393EPSS
SaveExploits0References7
PyPA
PyPA
•added 2026/09/10 9:44 a.m.•7 views

asyncssh has an incomplete fix for CVE-2026-45309 — AuthorizedKeysFile %u still escapes the intended directory via a leading ~ (and weakly via ${ENV}) username substitution

Incomplete fix for CVE-2026-45309 GHSA-g794-3fmp-753h. The 2.23.0 guard that sanitises the SSH username before %u substitution in AuthorizedKeysFile blocks /, \ and .., but does not block a leading or $ENV, both of which are re-introduced by later expansion and reach the file open — defeating the...

8.2CVSS6AI score0.00592EPSS
SaveExploits1References7Affected Software1
NVD
NVD
•added 2026/09/10 9:17 a.m.•9 views

CVE-2026-88282

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metacharacters to be executed as arbitrary root commands during a subsequent FTP-account update...

7.2CVSS0.0054EPSS
SaveExploits0References1
NVD
NVD
•added 2026/09/10 9:17 a.m.•8 views

CVE-2026-88273

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled PPPoE username to escape a sourced shell configuration assignment and execute arbitrary commands as root...

7.2CVSS0.00705EPSS
SaveExploits0References1
NVD
NVD
•added 2026/09/10 9:17 a.m.•12 views

CVE-2026-88272

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled username containing shell metacharacters to be executed as arbitrary root commands when the stored username is later deleted...

7.2CVSS0.0054EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/10 8:23 a.m.•41 views

CVE-2026-88282 GV-LPCLPC2011/2211 - Stored FTP-Username Command Injection

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metacharacters to be executed as arbitrary root commands during a subsequent FTP-account update...

7.2CVSS0.0054EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/10 8:23 a.m.•12 views

EUVD-2026-75316

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metacharacters to be executed as arbitrary root commands during a subsequent FTP-account update...

7.2CVSS5.8AI score0.0054EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
•added 2026/09/10 8:23 a.m.•13 views

CVE-2026-88282 GV-LPCLPC2011/2211 - Stored FTP-Username Command Injection

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metacharacters to be executed as arbitrary root commands during a subsequent FTP-account update...

7.2CVSS5.8AI score0.0054EPSS
SaveExploits0References1
CVE
CVE
•added 2026/09/10 8:23 a.m.•16 views

CVE-2026-88282

GeoVision GV-LPC2211 (LPC series) V1.13 contains a stored command injection vulnerability in its FTP username field. An administrator who sets an FTP username containing shell metacharacters can trigger arbitrary root command execution during a subsequent FTP-account update operation. The vulnera...

7.2CVSS5.8AI score0.0054EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
•added 2026/09/10 8:20 a.m.•13 views

CVE-2026-88273 GV-LPC2011/LPC2211 - PPPoE Username Shell-Configuration Command Injection

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled PPPoE username to escape a sourced shell configuration assignment and execute arbitrary commands as root...

7.2CVSS6.2AI score0.00705EPSS
SaveExploits0References1
CVE
CVE
•added 2026/09/10 8:20 a.m.•18 views

CVE-2026-88273

GeoVision GV-LPC2211 (version V1.13 ) is affected by a command injection vulnerability in its PPPoE username configuration. An administrator-controlled PPPoE username value can escape a sourced shell configuration assignment , allowing the execution of arbitrary commands as root . The attack requ...

7.2CVSS6.2AI score0.00705EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/10 8:20 a.m.•44 views

CVE-2026-88273 GV-LPC2011/LPC2211 - PPPoE Username Shell-Configuration Command Injection

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled PPPoE username to escape a sourced shell configuration assignment and execute arbitrary commands as root...

7.2CVSS0.00705EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/10 8:20 a.m.•11 views

EUVD-2026-75307

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled PPPoE username to escape a sourced shell configuration assignment and execute arbitrary commands as root...

7.2CVSS6.2AI score0.00705EPSS
SaveExploits0References1
Rows per page
Query Builder