atlassian-jwt-auth (>=2.0.0, <=2.1.0), pyjwe (0.1.4) +3 more potentially affected by CVE-2026-69249 via cryptography (1.0.2)

cryptography PYPI version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth =2.0.0, =1.0.1, =0.4.5, =0.5.0, =0.5.1 Source cves: CVE-2026-69249 Source advisory: OSV:PYSEC-2026-3553...

atlassian-jwt-auth (>=2.2.0, <=2.4.0) potentially affected by CVE-2026-69249 via cryptography (1.2.1)

cryptography PYPI version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth =2.2.0, =2.4.0 Source cves: CVE-2026-69249 Source advisory: OSV:PYSEC-2026-3553...

atlassian-jwt-auth (>=2.8.1, <=2.10.0), fallixy (0.18.1) +3 more potentially affected by CVE-2026-69249 via cryptography (1.5.3)

cryptography PYPI version 1.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth =2.8.1, =0.18.1, =0.9.0, =1.1.0 - teamvault 0.6.0 Source cves: CVE-2026-69249 Source advisory: OSV:PYSEC-2026-3553...

atlassian-jwt-auth (2.5.0), netlib (0.16.0) +1 more potentially affected by CVE-2026-69249 via cryptography (1.2.3)

cryptography PYPI version 1.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth 2.5.0 - netlib 0.16.0 - signxml =0.5.0, =1.0.0 Source cves: CVE-2026-69249 Source advisory: OSV:PYSEC-2026-3553...

PYSEC-2026-3578 linuxfabrik-lib: fetch() forwards credential headers across a cross-origin redirect

Summary lib.url.fetch follows HTTP redirects followredirects=True. httpx strips only Authorization and Cookie when a redirect crosses the origin, so any other caller-supplied credential header a session token such as Redfish's X-Auth-Token, an API key, ... was still sent to the redirect target. A...

PT-2026-67877

Name of the Vulnerable Software and Affected Versions Baserow versions prior to 2.3.3 Description An issue in the 2FA Verify Endpoint allows for improper authentication via remote manipulation. The flaw exists within the verify function located in the backend/src/baserow/api/two factor...

PT-2026-67818

Name of the Vulnerable Software and Affected Versions SSSD affected versions not specified Description A flaw exists in the PAM responder where the extract authtok v1 function fails to validate the auth token length field against the remaining buffer size before processing. A local attacker can...

CVE-2026-66902: Improper Neutralization of Special Elements used in an OS Command

Google::Auth versions before 0.06 for Perl run a command named in an externalaccount credentials JSON via an ungated system call. The Pluggable subclass reads credentialsource.executable.command from the credentials JSON and runs it as system$command, a single argument call that passes the whole...

CVE-2026-66901: Server-Side Request Forgery (SSRF)

Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON. The URLs the library requests are read from the credentials JSON, and their hosts were not checked against the universe domain before the...

RockyLinux 8 : mingw-glib2 (RLSA-2026:49512)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:49512 advisory. glib: GLib: Buffer underflow in GVariant parser leads to heap corruption CVE-2025-14087 glib: buffer over-read in glib/gvariant-serialiser.c via...

PT-2026-67855

Name of the Vulnerable Software and Affected Versions Google::Auth versions prior to 0.06 Description An issue exists where the software executes a command specified in an external account credentials JSON file through an ungated system call. The Pluggable subclass retrieves the credential...

PT-2026-73976

TuxCare rebuilt basic-auth-connect to address 1 CVE. Fixed in 1.0.0-tuxcare.1...

PT-2026-67854

Name of the Vulnerable Software and Affected Versions Google::Auth versions prior to 0.09 Description Google::Auth for Perl allows server side request forgery SSRF and credential exfiltration due to unvalidated URLs read from the credentials JSON. The library fails to check hosts against the...

JLSEC-2026-1135 Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input...

Issue Summary: Cryptographic Message Services CMS processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises. Impact Summary: Attackers making use of these vulnerabilities may achieve...

JLSEC-2026-1126

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a client which can connect to the leafnode port can crash the nats-server with a certain malformed message pre-authentication. Versions 2.11.15 and 2.12.6 contain ...

JLSEC-2026-1122

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.14 and 2.12.5, if the nats-server has the "leafnode" configuration enabled not default, then anyone who can connect can crash the nats-server by triggering a panic. This happens...

AZL-94517 CVE-2026-18651 affecting package 389-ds-base 3.1.1-12

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account-lock check. If the account is subsequently found to be locked, the bind is reported as failed to the client, but the already-installed...

CVE-2026-68586 SiYuan before v3.7.3 Content Disclosure via getBacklinkDoc

SiYuan before v3.7.3 fails to apply publish-access filters to the getBacklinkDoc and getBackmentionDoc content endpoints /api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc. While the corresponding backlink list endpoints filter publish-forbidden documents, the content endpoints gated only by...

Exploit for CVE-2026-60004

CVE-2026-60004 — Gitea Pre-Auth Remote Code Execution CVSS 9...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in CMS AuthEnvelopedData recipient processing, where AbstractRecipient and its recipient classes such as JceKeyTransRecipient and BcKeyTransRecipient take the AEAD tag length from the...