1880 matches found
Important: Red Hat Security Advisory: sssd security update
An update for sssd is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability...
CVE-2026-12383
A flaw was found in the Event-Driven Ansible EDA server. The ExternalEventStreamViewSet uses permissive access controls permissionclasses=AllowAny, authenticationclasses= and relies solely on the Subject HTTP header value for mTLS authentication without verifying that the header originated from a...
CVE-2026-66028
Ekushey Project Manager CRM through version 5.0 contains a missing uniqueness constraint vulnerability that allows authenticated administrators to create duplicate client accounts with identical email and password credentials. Attackers can exploit the lack of email field uniqueness enforcement t...
CVE-2026-17568
CVE-2026-17568 describes improper access control in Devolutions Server’s role membership management endpoint. An authenticated non-administrative user with user-group membership management permission can escalate to administrator via a crafted API request. Affected: Devolutions Server 2026.2.4.0–...
SUSE CVE-2026-16317
Missing validation of the outer contenttype byte on TLS 1.3 encrypted records in s2n-tls allows an active man-in-the-middle to silently discard individual application data records without either endpoint detecting the modification. RFC 8446 Section 5.2 requires that the outer contenttype of all...
UBUNTU-CVE-2026-50248
In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still considered as a possible XFR endpoint. A malicious actor that can spoof the hostname's A/AAAA record no valid RRSIG required becomes the zone'...
EUVD-2026-44671
LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULTTOKENSECRET and public /auth-status defeat LIGHTRAGAPIKEY protection...
CVE-2026-59733 rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --private-repos enforces authorization using the routed user path segment while building the backend object key from the raw uncleaned URL path,...
CVE-2026-15720
In Open5GS through version 2.7.7 a pre-authentication heap out-of-bounds read in the AMF NAS 5GS mobile-identity handler may result in subscriber-wide denial of service...
Linux Distros Unpatched Vulnerability : CVE-2026-57216
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, AMQP 0-9-1, AMQP 1.0, and Stream Protocol authentication can allow a...
CVE-2026-59190 Grav Admin Plugin — IDOR Privilege Escalation via saveUser()
grav-plugin-admin is an HTML user interface that provides a way to configure Grav and create and modify pages. In 1.10.52 and earlier, an authenticated attacker with admin.users permission can change the password of any user account, including the super administrator, by sending a direct POST...
PYSEC-2026-1862 Rasa Pro Missing Authentication For Voice Connector APIs
Vulnerability A vulnerability has been identified in Rasa Pro where voice connectors in Rasa Pro do not properly implement authentication even when a token is configured in the credentials.yml file. This could allow an attacker to submit voice data to the Rasa Pro assistant from an unauthenticate...
PYSEC-2026-1705 NiceGUI On Air authentication issue
Summary Once a user logins to one browser, all other browsers are logged in without entering password. Even incognito mode. Impact high...
CVE-2026-8458
libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different 'services'. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When...
Curl 8.15.0 < 8.21.0 SASL Double-Free
The version of curl installed on the remote host is 8.15.0 prior to 8.21.0. It is, therefore, affected by a double-free vulnerability: - The curl logic that works with SASL authentication could end up cleaning up the GSASL context twice without clearing the pointer in between, making it free the...
GO-2026-5690 opentelemetry-collector-contrib: githubreceiver silently ignores configured required_headers authentication in github.com/open-telemetry/opentelemetry-collector-contrib/receiver/githubreceiver
opentelemetry-collector-contrib: githubreceiver silently ignores configured requiredheaders authentication in github.com/open-telemetry/opentelemetry-collector-contrib/receiver/githubreceiver...
CVE-2026-10711
Missing authentication for critical function vulnerability in AKIN Software Computer Import Export Industry and Trade Ltd. CafePlus allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects CafePlus: from 12.05.03 before 12.05.04...
CVE-2026-11748
A vulnerability has been identified in centraldogma-server-auth-shiro versions prior to 0.84.0, where the SearchFirstActiveDirectoryRealm substitutes the login username into an LDAP search filter without neutralizing LDAP filter metacharacters, allowing an unauthenticated attacker to manipulate t...
UBUNTU-CVE-2026-55199
libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSHMSGEXTINFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can s...