CVE-2021-34824

CVE-2021-34824 repro reproducing an old istio bug This set of scripts and manifests will aid in exploring an old Istio security issue which allowed malicious Istio users to access Kubernetes secrets they should not have access to. This reproduction is modeled on this blog post which has some...

cve-2026-47777

CVE-2026-47777 — Omisión de Autorización de Colecciones Destacadas en Mastodon Resumen Divulgué de manera responsable una vulnerabilidad de Omisión de Autorización de Alta Gravedad que afecta el pipeline de federación experimental de Colecciones Destacadas de Mastodon. ID de CVE: CVE-2026-47777...

Security update for docker-stable

This update for docker-stable fixes the following issues: CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header bsc1260279. CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad...

SUSE-SU-2026:4535-1 Security update for docker-stable

This update for docker-stable fixes the following issues: - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header bsc1260279. - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad...

CVE-2026-52217-VTEX-Checkout-CrossTenant-IDOR

CVE-2026-52217 Fallo de autorización entre inquilinos y entre usuarios IDOR / BOLA en el servicio de Checkout de la plataforma de comercio VTEX. Campo| Valor ---|--- CVE ID| CVE-2026-52217 Vendor| VTEX Product| Plataforma de comercio VTEX, servicio de Checkout chk Affected| Observado en chk...

Security update for docker-stable

This update for docker-stable fixes the following issues: CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header bsc1260279. CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad...

SUSE-SU-2026:4533-1 Security update for docker-stable

This update for docker-stable fixes the following issues: - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header bsc1260279. - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad...

Authorization Bypass

langgraphsdk is vulnerable to an authorization bypass. The vulnerability is due to the @auth.on.threads, @auth.on.assistants, and @auth.on.crons decorators ignoring the specified actions argument, which allows an authenticated attacker to bypass fallback permission or ownership checks and read,...

RLSA-2026:75571 Important: sudo security update

The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root. Security Fixes: sudo: sudo: TZ environment variable allows...

sudo security update

An update is available for sudo. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The sudo packages contain the sudo utility which allows system administrators to...

sudo security update

An update is available for sudo. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The sudo packages contain the sudo utility which allows system administrators to...

RLSA-2026:75580 Important: sudo security update

The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root. Security Fixes: sudo: sudo: TZ environment variable allows...

EUVD-2026-92968

The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored si...

CVE-2026-46558

CVE-2026-46558 El subsistema de activos V2 de Plane confiaba en slugs de espacios de trabajo y UUIDs de activos sin aplicar las comprobaciones de membresía correctas, lo que permitía a un usuario autenticado leer, copiar, eliminar y sobrescribir activos en otros espacios de trabajo. Introducción...

CVE-2026-105572

A vulnerability has been found in PickMall Lilishop up to 4.2.4. This affects an unknown function of the file /buyer/trade/receipt of the component Buyer Invoice List. Such manipulation of the argument memberId leads to authorization bypass. It is possible to launch the attack remotely. The explo...

Thank-u-Next

Thank u Next – Herramienta de Explotación CVE-2025-29927 🧠 ¿Qué es CVE-2025-29927? No es solo un bypass — es una revelación. Un único encabezado, malinterpretado y mal manejado por la lógica del middleware, se convierte en una llave maestra hacia lo que debía estar cerrado. CVE-2025-29927 explota...

EUVD-2026-92930

A vulnerability has been found in PickMall Lilishop up to 4.2.4. This affects an unknown function of the file /buyer/trade/receipt of the component Buyer Invoice List. Such manipulation of the argument memberId leads to authorization bypass. It is possible to launch the attack remotely. The explo...

CVE-2026-105572

A vulnerability exists in PickMall Lilishop version 4.2.4 and below, specifically within the Buyer Invoice List component. An unknown function in the /buyer/trade/receipt file is susceptible to authorization bypass when the memberId argument is manipulated. This flaw is exploitable remotely . Pub...

CVE-2026-105572 PickMall Lilishop Buyer Invoice List receipt authorization

A vulnerability has been found in PickMall Lilishop up to 4.2.4. This affects an unknown function of the file /buyer/trade/receipt of the component Buyer Invoice List. Such manipulation of the argument memberId leads to authorization bypass. It is possible to launch the attack remotely. The explo...

CVE-2026-105572 PickMall Lilishop Buyer Invoice List receipt authorization

A vulnerability has been found in PickMall Lilishop up to 4.2.4. This affects an unknown function of the file /buyer/trade/receipt of the component Buyer Invoice List. Such manipulation of the argument memberId leads to authorization bypass. It is possible to launch the attack remotely. The explo...