CVE-2026-73519

WolfStack before version 25.9.2 contains a hard-coded cluster-authentication secret compiled into builds (src/auth/mod.rs). Attackers can bypass require_auth() by sending the secret in the X-WolfStack-Secret header, without a session, API key, or user account. From a management port, an attacker ...

CVE-2026-73519 WolfStack < 25.9.2 Hard-coded Secret Authentication Bypass via X-WolfStack-Secret

WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing remote unauthenticated attackers to bypass authentication by supplying this value in the X-WolfStack-Secret header to the requireauth gate...

CVE-2026-73305

creationtimestamp| type| source ---|---|--- 2026-08-12 20:35:26+00:00| published-proof-of-concept| https://github.com/Budibase/budibase/security/advisories/GHSA-j9fc-w3mr-x6mv 2026-08-14 01:01:02+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msyxhdipyh26...

CVE-2026-73406

creationtimestamp| type| source ---|---|--- 2026-08-12 20:35:13+00:00| published-proof-of-concept| https://github.com/Budibase/budibase/security/advisories/GHSA-hr66-5mqr-8mpx 2026-08-12 21:01:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msvzmlg3ko22...

CVE-2026-16723 vulnerabilities

Vulnerabilities for packages: seata...

CVE-2026-59845 vulnerabilities

Vulnerabilities for packages: libssh...

CVE-2026-59847 vulnerabilities

Vulnerabilities for packages: libssh...

CVE-2026-59848 vulnerabilities

Vulnerabilities for packages: libssh...

GHSA-JP6G-7MQJ-WJ53 vulnerabilities

Vulnerabilities for packages: libssh...

CVE-2026-59843 vulnerabilities

Vulnerabilities for packages: libssh...

GHSA-6J7F-8JJP-MM8C vulnerabilities

Vulnerabilities for packages: libssh...

CVE-2026-59842 vulnerabilities

Vulnerabilities for packages: libssh...

CVE-2026-59849 vulnerabilities

Vulnerabilities for packages: libssh...

GHSA-FVWJ-J79Q-57V7 vulnerabilities

Vulnerabilities for packages: libssh...

GHSA-X94W-CG8G-G593 vulnerabilities

Vulnerabilities for packages: libssh...

GHSA-QP28-HPG5-J7XC vulnerabilities

Vulnerabilities for packages: libssh...

CVE-2026-54465 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce...

CVE-2026-54464 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce...

GHSA-GHHP-3QVG-889P vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce...

CVE-2026-73419 NextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them

NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to the provider that created them. On callback, a check value...