183949 matches found
Update your Mac: Screen Sharing vulnerability exploited in the wild
The Dutch National Cyber Security Centre NCSC issued a warning after being notified of several incidents where a vulnerability in Apple’s Screen Sharing feature was exploited to install Monero cryptominers. The vulnerability, tracked as CVE-2026-65400, was patched by Apple on August 6. It is an...
Memory Allocation With Excessive Size Value
Apache ActiveMQ is vulnerable to Memory Allocation with Excessive Size Value. The vulnerability is due to insufficient validation of the size value in a pre-authentication WireFormatInfo frame, which allows an unauthenticated remote attacker to trigger excessive memory allocation and crash the...
Authentication Bypass
org.apache.cxf, cxf-rt-rs-security-oauth2 is vulnerable to an Authentication Bypass. The vulnerability is due to a missing throw statement in the security context check, which allows an unauthenticated network attacker to access the /services/oauth2/introspect endpoint and perform token...
389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica ID parsing
A stack buffer overflow flaw was found in 389 Directory Server 389-ds-base. The getruvelementfromberval function in repl5ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP...
WordPress User Profile Builder plugin <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter vulnerability
Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter vulnerability discovered by Supakiad S. m3ez - E-CQURITY Thailand in WordPress Plugin Profile Builder versions = 3.16.4...
WordPress User Session Synchronizer plugin <= 1.4.0 - Unauthenticated Authentication Bypass to Account Takeover via 'ussync-key', 'ussync-token', and 'ussync-ref' Parameters vulnerability
Unauthenticated Authentication Bypass to Account Takeover via 'ussync-key', 'ussync-token', and 'ussync-ref' Parameters vulnerability discovered by WordFence in WordPress Plugin User Session Synchronizer versions = 1.4.0...
MINI-6GC4-C72W-VFQX
Bulletin has no description...
MINI-5XRG-PFX6-3QQQ
Bulletin has no description...
MINI-PQV5-5XMH-V4WM
Bulletin has no description...
MINI-XH34-53RP-9J9Q
Bulletin has no description...
MINI-JJ8J-CJVX-446F
Bulletin has no description...
MINI-QRJ5-QC32-6GQ5
Bulletin has no description...
MINI-VFQ3-MHP9-GRPF
Bulletin has no description...
glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive
A flaw was found in GLib. The D-Bus client-side implementation of the DBUSCOOKIESHA1 SASL authentication mechanism does not validate the cookiecontext parameter received from the server. A malicious D-Bus server can supply a cookiecontext containing path traversal sequences, causing the client to...
GDBusServer: glib2: GDBusServer pre-authentication DoS via unbounded SASL line buffering
A denial-of-service and resource exhaustion vulnerability exists within the GDBus component of GLib. The gdbusauth authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input...
WordPress miniOrange 2FA plugin < 6.2.6 - 2FA Bypass vulnerability
2FA Bypass vulnerability discovered by Shivamani Vastrala in WordPress Plugin miniOrange's Google Authenticator versions 6.2.6...
Important: Red Hat Security Advisory: curl security update
An update for curl is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...
curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication
A flaw was found in curl. When an application uses libcurl to make multiple Negotiate-authenticated HTTP or HTTPS requests to the same server with different credentials, libcurl may incorrectly reuse an existing connection. This logical error can cause a subsequent request to be sent using the...
BIT-GITLAB-2026-13113 Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 17.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to merge code into a protected branch without the required approvals due to a race conditio...
BIT-SEAWEEDFS-2026-72920 SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control
SeaweedFS is a distributed storage system. Prior to 4.24, the filer registers the SeaweedIdentityAccessManagement gRPC service without mandatory authentication when jwt.filersigning.key is unset, allowing any client that can reach the filer gRPC port to invoke CreateUser, CreateAccessKey,...