14606 matches found
com.synopsys.jenkinsci:ownership (>=365.v2cc1889ec61d, <=373.vb_41d439617c2), org.jenkins-ci.plugins:azure-ad (>=378.vd6e2874a_69eb, <=678.vf350db_9b_563a) +2 more potentially affected by CVE-2026-42521 via org.jenkins-ci.plugins:matrix-auth (>=3.1.5, <=3.2.9)
org.jenkins-ci.plugins:matrix-auth MAVEN version =3.1.5, =365.v2cc1889ec61d, =378.vd6e2874a69eb, =2.1.0, =1.1.0.227.v27e08dfb1a20, =1.1.0.263.v2e0ddecf8b25 Source cves: CVE-2026-42521 Source advisory: GHSA-JP9R-MMHW-VFF3...
CLSA-2026-1777463410 dovecot: Fix of CVE-2017-15132
CVE-2017-15132: fix memory leak and hash-table use-after-free in authclientrequestabort lib-auth. Squashed upstream commits 1a29ed2f96da and a9b135760aea...
MAL-2026-3259 Malicious code in enterprise-auth-gateway-core (npm)
Dependency confusion and typosquatting campaign by threat actor "saif777". Packages use inflated version numbers 9999.9999.9999, 9999.9999.10000, 50.50.50, 7.66.5 to win version resolution in environments with private registries. All active packages execute a postinstall hook "node index.js" that...
com.synopsys.jenkinsci:ownership (>=365.v2cc1889ec61d, <=373.vb_41d439617c2), org.jenkins-ci.plugins:azure-ad (>=378.vd6e2874a_69eb, <=678.vf350db_9b_563a) +2 more potentially affected by CVE-2026-42521 via org.jenkins-ci.plugins:matrix-auth (>=3.1.5, <=3.2.9)
org.jenkins-ci.plugins:matrix-auth MAVEN version =3.1.5, =365.v2cc1889ec61d, =378.vd6e2874a69eb, =2.1.0, =1.1.0.227.v27e08dfb1a20, =1.1.0.263.v2e0ddecf8b25 Source cves: CVE-2026-42521 Source advisory: MEND:CVE-2026-42521...
Malicious code in period-newline (npm)
Malicious npm package published by threat actor "ryanmccollum1" impersonating a benign text-formatting utility. Part of the same supply chain attack campaign as redeem-onchain-sdk, which collects SSH keys, AWS credentials, .npmrc tokens, Docker auth, Chrome saved logins, .env files, and git...
PT-2026-37642
Name of the Vulnerable Software and Affected Versions mongo-c-driver affected versions not specified Description The Cyrus SASL integration in the MongoDB C Driver performs unsafe string copying during username canonicalization. This flaw enables a heap buffer overflow—a condition where data...
Unsafe deserialization allows invoking parameterless constructors in matrix-auth
matrix-auth 2.0-beta-1 through 3.2.9 both inclusive invokes parameterless constructors of classes specified in configuration when deserializing inheritance strategies, without restricting the classes that can be instantiated. This can be abused by attackers with Item/Configure permission to...
CVE-2026-41916
OpenClaw before 2026.4.8 contains an authentication state management vulnerability where the resolvedAuth closure becomes stale after configuration reload. Newly accepted gateway connections continue using outdated resolved auth state, allowing attackers to bypass authentication controls through...
CVE-2026-41394
OpenClaw before 2026.3.31 contains an authentication bypass vulnerability where unauthenticated plugin-auth HTTP routes receive operator runtime write scopes. Attackers can access these routes without authentication to perform privileged runtime actions intended for authorized operators...
Spring gRPC SecurityContext leaks across requests upon authorization failure
When an authenticated user is denied access to a gRPC method, their authenticated identity remains bound to the gRPC worker thread and can be inherited by a subsequent unauthenticated request on the same thread. This may allow the subsequent user to gain escalated permissions. Affected versions:...
CVE-2026-41394: Missing Authorization
OpenClaw before 2026.3.31 contains an authentication bypass vulnerability where unauthenticated plugin-auth HTTP routes receive operator runtime write scopes. Attackers can access these routes without authentication to perform privileged runtime actions intended for authorized operators...
PT-2026-35798
OpenClaw before 2026.4.8 contains an authentication state management vulnerability where the resolvedAuth closure becomes stale after configuration reload. Newly accepted gateway connections continue using outdated resolved auth state, allowing attackers to bypass authentication controls through...
PT-2026-35728
CVE-2026-29017: Atlassian Confluence OGNL Injection — Pre-Auth RCE https://t.co/kcWQ5p0sYk anthropic aisecurity alert cybersecurity...
CVE-2026-41427
Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.5, the clientPrivileges option documents a create action, but the OAuth client creation endpoints did not invoke the hook before persisting new clients. Deployments that configured clientPrivileges to restrict...
JLSEC-2026-256 Issue summary: Parsing CMS AuthEnvelopedData message with maliciously crafted AEAD parameters can...
Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When parsing CMS...
PT-2026-35395
Name of the Vulnerable Software and Affected Versions NousResearch hermes-agent version 0.8.0 Description A flaw in the Webhooks Endpoint component, specifically within the gateway/platforms/webhook.py file, allows for missing authentication. This occurs through the manipulation of the INSECURE N...
Fedora 42 : coturn (2026-e673311164)
The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-e673311164 advisory. Coturn 4.10.0 Performance Add Linux-only recvmmsg client receive path for DTLS/UDP listener Skip response buffer allocation for STUN indications...
OpenClaw: Assistant media route missed scope enforcement for trusted-proxy authorization
Affected Packages / Versions - Package: openclaw npm - Affected versions: 2026.4.20 - Patched version: 2026.4.20 Impact The Control UI assistant-media route authenticated trusted-proxy callers but did not enforce the declared operator scopes for identity-bearing HTTP auth paths. A trusted-proxy...
