1660 matches found
SUSE CVE-2026-55438
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, Coder's subdomain-based workspace app proxy allowed the same-owner CORS check to be bypassed. When a workspace-name subdomain segment parsed as a UUID, the...
CVE-2026-63238
An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, including administrator accounts, by supplying a valid user UUID without providing primary credentials via the 2FA validation endpoint...
CVE-2026-63238 Authentication bypass vulnerability
An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, including administrator accounts, by supplying a valid user UUID without providing primary credentials via the 2FA validation endpoint...
EUVD-2026-50133
An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, including administrator accounts, by supplying a valid user UUID without providing primary credentials via the 2FA validation endpoint...
CVE-2026-57510 SuperPlane < 0.27.0 Broken Object Level Authorization via CanvasService gRPC
SuperPlane before 0.27.0 contains a broken object-level authorization vulnerability in the CanvasService gRPC handlers that allows authenticated users with viewer-level access to one organization to access resources belonging to other organizations by supplying arbitrary canvas or queue UUIDs...
Improper Restriction of Security Token Assignment
Overview Affected versions of this package are vulnerable to Improper Restriction of Security Token Assignment via the /upload/file endpoint accepting any valid panel-signed JWT containing serveruuid, useruuid, and uniqueid claims without verifying the token's intended purpose. An attacker can...
CVE-2026-54593
Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained serveruuid, useruuid, and uniqueid claims without checking the token's intended purpose;...
Malicious code in date-uuid (npm)
Source: amazon-inspector 58dffbe61370f78deed5bacbc8f6bc46a8a989f03da218643a41b52ed025fa6a Package advertised as a UUIDv7 helper, but on require/import it auto-invokes extractDateISO in bootstrap.js, which reads README.md from process.cwd, extracts two specific lines 120 and 123, and base64-decode...
Linux Distros Unpatched Vulnerability : CVE-2026-66139
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known. CVE-2026-66139 Note that Nessus relies on the presenc...
Exploit for OS Command Injection in Ispyconnect Agent_Dvr
CVE-2025-63408 --- path-traversal.py: A re-implementation o...
CVE-2026-66139
OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known...
CVE-2026-66139
OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known...
CVE-2026-66139
OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known...
CVE-2026-66139
OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known...
EUVD-2026-48477
OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known...
CVE-2026-66139: Missing Authentication for Critical Function
OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known...
EUVD-2026-47745
Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnerability that allows authenticated attackers to access and manipulate other users' resources by supplying arbitrary UUID values to tRPC API procedures including project.get, member.remove, and...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization in the attachment update. An attacker can access private attachment content by re-linking a known attachment UUID to an issue or comment in a repository they control, causing authorization checks to be performed...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization in the attachment update. An attacker can access private attachment content by re-linking a known attachment UUID to an issue or comment in a repository they control, causing authorization checks to be performed...
GHSA-Q9PG-JJ6X-J9P6 Gitea: draft release attachment disclosure via missing web authorization
Summary Gitea's draft-release access control is enforced only on the API release endpoints /api/v1/repos/owner/repo/releases/id and its /assets/... sub-routes but not on the web-level UUID-based attachment endpoints /attachments/uuid, /owner/repo/attachments/uuid,...