CVE-2026-73499

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey to receive watch events for every key lexicographically greater than o...

CVE-2026-73501

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load in openapi3filter/validationhandler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI...

CVE-2026-73501 kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load in openapi3filter/validationhandler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI...

CVE-2026-73418

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken helper in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when it reads a malformed Authorization: Bearer header. When no session...

CVE-2026-73430 Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)

Russh is a Rust SSH client & server library. Prior to 0.62.4, an unauthenticated SSH client can cause a denial of service by sending SSHMSGKEXECDHINIT with a 32-byte all-zero QC value. Curve25519Kex::serverdh in russh/src/kex/curve25519.rs accepts the all-zero peer public value and computes an...

CVE-2026-73430 Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)

Russh is a Rust SSH client & server library. Prior to 0.62.4, an unauthenticated SSH client can cause a denial of service by sending SSHMSGKEXECDHINIT with a 32-byte all-zero QC value. Curve25519Kex::serverdh in russh/src/kex/curve25519.rs accepts the all-zero peer public value and computes an...

CVE-2026-73430

Russh (Rust SSH client/server library) before version 0.62.4 is affected. An unauthenticated SSH client can trigger a denial of service by sending SSH_MSG_KEX_ECDH_INIT with a 32-byte all-zero Q_C value. In Curve25519Kex::server_dh, the all-zero peer public value is accepted, leading to a zero sh...

CVE-2026-73430 Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)

Russh is a Rust SSH client & server library. Prior to 0.62.4, an unauthenticated SSH client can cause a denial of service by sending SSHMSGKEXECDHINIT with a 32-byte all-zero QC value. Curve25519Kex::serverdh in russh/src/kex/curve25519.rs accepts the all-zero peer public value and computes an...

CVE-2026-73429 Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)

Russh is a Rust SSH client & server library. Prior to 0.62.4, a malicious SSH server can crash a russh client session with a malformed KEXECDHREPLY containing a server ephemeral value that is not 32 bytes long. The client-side Curve25519Kex::computesharedsecret function in...

CVE-2026-73429 Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)

Russh is a Rust SSH client & server library. Prior to 0.62.4, a malicious SSH server can crash a russh client session with a malformed KEXECDHREPLY containing a server ephemeral value that is not 32 bytes long. The client-side Curve25519Kex::computesharedsecret function in...

CVE-2026-73429

CVE-2026-73429 affects Russh (Rust SSH client/server library) prior to v0.62.4. A malicious SSH server can trigger a deterministic panic in the client during KEX_ECDH_REPLY handling when the server_ephemeral value is not 32 bytes, as Curve25519Kex::compute_shared_secret passes the decoded value t...

@app-box/web (1.0.0), @chirpy-dev/analytics (0.0.1) +87 more potentially affected by CVE-2026-73419 via next-auth (>=0.0.0-manual.83c4ebd1, <=4.24.13)

next-auth NPM version =0.0.0-manual.83c4ebd1, =0.1.0, =1.9.0, =3.0.0-canary.160.0, =2.0.1-canary.24.0, =1.9.9, =0.1.0-0, =1.5.0, =0.0.2, =1.0.1 - @lowdefy/community-plugin-auth 1.0.4 and more Source cves: CVE-2026-73419 Source advisory: MEND:CVE-2026-73419...

@aangeles/jefeui (>=1.10.0, <=1.11.6), @aion0/forge (>=0.1.0, <=0.15.56) +67 more potentially affected by CVE-2026-73419 via next-auth (>=5.0.0-beta.3, <=5.0.0-beta.31)

next-auth NPM version =5.0.0-beta.3, =1.10.0, =0.1.0, =1.2.0, =0.1.0, =1.2.4-main.127b5b3.33, =0.0.2, =0.1.0-rc.1, =1.0.0, =0.1.6, =1.0.0, =0.106.0-rc.0, =1.0.16, =1.0.17 - @irshadkhan-dev/pandapulse-db 0.0.1 and more Source cves: CVE-2026-73419 Source advisory: MEND:CVE-2026-73419...

@12-apps/app-shell (>=1.0.0, <=5.13.1), @12-apps/auth (>=1.2.0, <=2.30.1) +270 more potentially affected by CVE-2026-73419 via @auth/core (>=0.0.0-manual.fdbc96ab, <=0.41.2)

@auth/core NPM version =0.0.0-manual.fdbc96ab, =1.0.0, =1.2.0, =1.3.0, =3.0.0, =4.11.0, =1.10.0, =0.1.0, =0.0.1, =1.0.0, =1.0.1 - @anish-karthik/create-next-app 1.0.1 - @api-buddy/cli 3.0.5 - @api-buddy/plugin-auth-firebase 3.0.3 - @aponia.js/adapter-prisma 0.2.0 and more Source cves:...

CVE-2026-73418 NextAuth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken helper in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when it reads a malformed Authorization: Bearer header. When no session...

CVE-2026-73418

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken helper in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when it reads a malformed Authorization: Bearer header. When no session...

@aangeles/jefeui (>=1.10.0, <=1.11.6), @aion0/forge (>=0.1.0, <=0.15.56) +67 more potentially affected by CVE-2026-73418 via next-auth (>=5.0.0-beta.3, <=5.0.0-beta.31)

next-auth NPM version =5.0.0-beta.3, =1.10.0, =0.1.0, =1.2.0, =0.1.0, =1.2.4-main.127b5b3.33, =0.0.2, =0.1.0-rc.1, =1.0.0, =0.1.6, =1.0.0, =0.106.0-rc.0, =1.0.16, =1.0.17 - @irshadkhan-dev/pandapulse-db 0.0.1 and more Source cves: CVE-2026-73418 Source advisory: MEND:CVE-2026-73418...

@chirpy-dev/analytics (0.0.1), @chirpy-dev/bootstrapper (0.1.0) +54 more potentially affected by CVE-2026-73418 via next-auth (>=4.1.2, <=4.24.13)

next-auth NPM version =4.1.2, =0.1.0, =1.9.0, =1.9.9, =0.1.0-0, =1.5.0, =0.0.2, =1.0.0, =1.0.0, =0.0.0-experimental-20231123101256, =5.1.0 and more Source cves: CVE-2026-73418 Source advisory: MEND:CVE-2026-73418...

@12-apps/app-shell (>=1.0.0, <=5.13.1), @12-apps/auth (>=1.2.0, <=2.30.1) +268 more potentially affected by CVE-2026-73418 via @auth/core (>=0.1.0, <=0.41.2)

@auth/core NPM version =0.1.0, =1.0.0, =1.2.0, =1.3.0, =3.0.0, =4.11.0, =1.10.0, =0.1.0, =0.0.1, =1.0.0, =1.0.1 - @anish-karthik/create-next-app 1.0.1 - @api-buddy/cli 3.0.5 - @api-buddy/plugin-auth-firebase 3.0.3 - @aponia.js/adapter-prisma 0.2.0 and more Source cves: CVE-2026-73418 Source...

CVE-2026-73306

Budibase (open-source low-code platform) is vulnerable prior to version 3.39.25 due to the login flow at POST /api/global/auth/:tenantId/login. The failure counter was incremented only for existing users, while emailLockout logic in packages/worker/src/middleware/emailLockout.ts surfaced X-Accoun...