CVE-2026-1580

A security issue was discovered in ingress-nginx where the nginx.ingress.kubernetes.io/auth-method Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to t...

CVE-2026-1580 ingress-nginx auth-method nginx configuration injection

A security issue was discovered in ingress-nginx where the nginx.ingress.kubernetes.io/auth-method Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to t...

CVE-2025-70758

chetans9 core-php-admin-panel through commit a94a780d6 contains an authentication bypass vulnerability in includes/authvalidate.php. The application sends an HTTP redirect via headerLocation:login.php when a user is not authenticated but fails to call exit afterward. This allows remote...

ROS-20260203-73-0006

A vulnerability in the auth.c component of the Linux kernel is related to memory usage after it has been freed. Exploitation of the vulnerability could allow an attacker to gain access to sensitive data, compromise its integrity, and cause denial of service...

Kubernetes ingress-nginx security vulnerability

Kubernetes ingress-nginx is a Kubernetes entry controller open-sourced by the Cloud Native Computing Foundation. It uses NGINX as a reverse proxy and load balancer. There is a security vulnerability in Kubernetes ingress-nginx. This vulnerability stems from the...

CVE-2026-24513: Improper Check for Unusual or Exceptional Conditions

A security issue was discovered in ingress-nginx where the protection afforded by the auth-url Ingress annotation may not be effective in the presence of a specific misconfiguration. If the ingress-nginx controller is configured with a default custom-errors configuration that includes HTTP errors...

CVE-2026-1580: Improper Input Validation

A security issue was discovered in ingress-nginx where the nginx.ingress.kubernetes.io/auth-method Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to t...

Kubernetes ingress-nginx security vulnerability

Kubernetes ingress-nginx is a Kubernetes entry controller open-sourced by the Cloud Native Computing Foundation. It uses NGINX as a reverse proxy and load balancer. There is a security vulnerability in Kubernetes ingress-nginx. This vulnerability arises from the protection provided by the auth-ur...

CVE-2025-6592 Creating a permanent account from a temporary account associates temp username and IP address with real username in AbuseLog

Vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program files includes/auth/AuthManager.Php. This issue affects AbuseFilter: from fe0b1cb9e9691faf4d8d9bd80646589f6ec37615 before 1.43.2, 1.44.0...

CVE-2025-6592

Vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program files includes/auth/AuthManager.Php. This issue affects AbuseFilter: from fe0b1cb9e9691faf4d8d9bd80646589f6ec37615 before 1.43.2, 1.44.0...

CVE-2025-6597

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/auth/AuthManager.Php. This issue affects MediaWiki: from before 1.39.13, 1.42.7, 1.43.2, 1.44.0...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (>=0.11.0, <=1.0.0.beta1), org.keycloak:keycloak-account-freemarker (1.0-beta-3) +1 more potentially affected by CVE-2025-13881 via org.keycloak:keycloak-services (1.0-beta-3)

org.keycloak:keycloak-services MAVEN version 1.0-beta-3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server =0.11.0, =1.0.0.beta1 -...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (1.0.3), org.keycloak:keycloak-account-freemarker (1.0.5.final) +4 more potentially affected by CVE-2025-13881 via org.keycloak:keycloak-services (1.0.5.final)

org.keycloak:keycloak-services MAVEN version 1.0.5.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server 1.0.3 -...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (1.0.0.beta2), org.keycloak:keycloak-account-freemarker (1.0-beta-4) +3 more potentially affected by CVE-2025-13881 via org.keycloak:keycloak-services (1.0-beta-4)

org.keycloak:keycloak-services MAVEN version 1.0-beta-4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server 1.0.0.beta2 -...

de.adorsys.keycloak:user-secret-adapter-embedded (1.0.7), de.adorsys.keycloak:user-secret-auth-provider (1.0.7) +12 more potentially affected by CVE-2025-13881 via org.keycloak:keycloak-services (7.0.0)

org.keycloak:keycloak-services MAVEN version 7.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.keycloak:user-secret-adapter-embedded 1.0.7 -...

ingress-nginx auth-url protection bypass

CVSS Rating: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N A security issue was discovered in ingress-nginx where the protection afforded by the auth-url Ingress annotation may not be effective in the presence of a specific misconfiguration. If the ingress-nginx controller is configured with a...

ingress-nginx auth-method nginx configuration injection

CVSS Rating: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H A security issue was discovered in ingress-nginx where the nginx.ingress.kubernetes.io/auth-method Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the...

CVE-2025-6597: Improper Limitation of a Pathname to a Restricted Directory

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/auth/AuthManager.Php. This issue affects MediaWiki: from before 1.39.13, 1.42.7, 1.43.2, 1.44.0...

PT-2026-6421

Summary 1. A hardcoded secret key used for signing JWTs is checked into source code 2. ManyAPI routes do not check authentication Details I am using the publicly available docker image at ghcr.io/maziggy/bambuddy 1. Hardcoded JWT Secret Key...

Insertion of Sensitive Information into Log File

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the userapikeyauthbuilder function, which leaks expired session keys into the authentication error output of other...