Lucene search
+L

77596 matches found

EUVD
EUVD
added 6 days ago9 views

EUVD-2026-57268

Apache Airflow's asset materialization endpoint POST /api/v2/assets/assetid/materialize and the XCom result check on waitdagrununtilfinished authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a global o...

5.4AI score0.00328EPSS
SaveExploits0References2
CVE
CVE
added 6 days ago30 views

CVE-2026-68971

CVE-2026-68971 (Apache Airflow) describes a cross-team authorization bypass in the asset materialization endpoint (POST /api/v2/assets/{asset_id}/materialize) and the XCom result check on wait_dag_run_until_finished. A team-aware auth manager failed to consult the team-scoped permission, treating...

6.5CVSS5.4AI score0.00328EPSS
SaveExploits0References3Affected Software1
OSV
OSV
added 6 days ago11 views

CVE-2026-68971 Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints

Apache Airflow's asset materialization endpoint POST /api/v2/assets/assetid/materialize and the XCom result check on waitdagrununtilfinished authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a global o...

6.5CVSS5.4AI score
SaveExploits0References6
ATTACKERKB
ATTACKERKB
added 6 days ago6 views

CVE-2026-65938

In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API allows any authenticated user to invoke restricted actions...

4.3CVSS5.2AI score0.00161EPSS
SaveExploits0References4
EUVD
EUVD
added 6 days ago9 views

EUVD-2026-57263

In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API allows any authenticated user to invoke restricted actions...

4.3CVSS5.2AI score0.00161EPSS
SaveExploits0References3
CVE
CVE
added 6 days ago32 views

CVE-2026-65938

WhatsUp Gold is affected in versions released before 2026.0.2 by an improper authorization vulnerability in the Scheduled Reports API that lets any authenticated user invoke restricted actions. The issue is documented across CVE-2026-65938 entries (NVD, CVE List) and is addressed in the 26.0.2 re...

4.3CVSS5.2AI score0.00161EPSS
SaveExploits0References3
NVD
NVD
added 6 days ago7 views

CVE-2026-73405

An authorization bypass vulnerability in Vulnerability-Lookup allowed inactive or unconfirmed accounts to subscribe to Server-Sent Events SSE streams through the /pubsub/subscribe/ endpoint. The tokenrequired decorator used by the Pub/Sub interface authenticated requests solely by matching the...

5.3CVSS0.00285EPSS
SaveExploits0References1
NVD
NVD
added 6 days ago7 views

CVE-2026-73287

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS handles FTPS MKD in FtpsDriver::mkd in crates/protocols/src/ftps/driver.rs by calling storage.createbucket without authorizeoperation for S3Action::CreateBucket, allowing authenticated FTPS users denied...

5.4CVSS0.00211EPSS
SaveExploits0References3
NVD
NVD
added 6 days ago8 views

CVE-2026-73265

RustFS is a distributed object storage system built in Rust. RustFS authorizes explicit versionId reads in GetObject, CopyObject sources, and UploadPartCopy sources with s3:GetObject instead of s3:GetObjectVersion, allowing principals without historical-version permission to disclose known...

6.5CVSS0.00304EPSS
SaveExploits0References4
Snyk
Snyk
added 6 days ago6 views

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the process that handles backend controller method dispatching via the handler POST field. An attacker can execute unauthorized controller methods by submitting crafted POST requests...

7.1CVSS5.8AI score
SaveExploits0References3
EUVD
EUVD
added 6 days ago9 views

EUVD-2026-57248

An authenticated user may view private Puppet module metadata without repository read access...

4.3CVSS5.2AI score0.00204EPSS
SaveExploits0References2
Cvelist
Cvelist
added 6 days ago31 views

CVE-2026-66378 Authenticated users may access private NuGet metadata

An authenticated user without repository read permission may access private NuGet metadata under specific conditions...

4.3CVSS0.00204EPSS
SaveExploits0References2
OSV
OSV
added 6 days ago4 views

CVE-2026-73287 RustFS: FTPS MKD bypasses IAM CreateBucket authorization

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS handles FTPS MKD in FtpsDriver::mkd in crates/protocols/src/ftps/driver.rs by calling storage.createbucket without authorizeoperation for S3Action::CreateBucket, allowing authenticated FTPS users denied...

5.4CVSS5.4AI score
SaveExploits0References5
CVE
CVE
added 6 days ago29 views

CVE-2026-73287

RustFS prior to v1.0.0-beta.12 contains a vulnerability in FtpsDriver::mkd where FTPS MKD calls storage.create_bucket without performing authorize_operation for S3Action::CreateBucket. This could allow authenticated FTPS users who are denied s3:CreateBucket to create buckets. The issue is fixed i...

5.4CVSS5.3AI score0.00211EPSS
SaveExploits0References3
Cvelist
Cvelist
added 6 days ago31 views

CVE-2026-73287 RustFS: FTPS MKD bypasses IAM CreateBucket authorization

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS handles FTPS MKD in FtpsDriver::mkd in crates/protocols/src/ftps/driver.rs by calling storage.createbucket without authorizeoperation for S3Action::CreateBucket, allowing authenticated FTPS users denied...

5.4CVSS0.00211EPSS
SaveExploits0References3
Cvelist
Cvelist
added 6 days ago34 views

CVE-2026-73286 RustF: Request headers can populate server-derived IAM condition keys, letting a caller satisfy identity-based policy conditions

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS getconditionvalues folds attacker-controlled request headers from HeaderMap into server-derived userid, username, principaltype, groups, versionid, signatureversion, jwt:, and ldap: condition keys, allowin...

8.1CVSS0.00238EPSS
SaveExploits0References4
EUVD
EUVD
added 6 days ago7 views

EUVD-2026-57229

RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by RUSTFSPOLICYPLUGINURL in crates/iam/src/sys.rs sets PreparedIamAuth.needsexistingobjecttag incorrectly for PreparedIamMode::Opa, causing...

7.5CVSS5.3AI score0.00346EPSS
SaveExploits0References4
CVE
CVE
added 6 days ago28 views

CVE-2026-73285

RustFS (distributed object storage in Rust) up to version 1.0.0-rc.1 is affected. The external OPA authorization configured via RUSTFS_POLICY_PLUGIN_URL in crates/iam/src/sys.rs incorrectly sets PreparedIamAuth.needs_existing_object_tag for PreparedIamMode::Opa, which can cause maybe_merge_object...

7.5CVSS5.3AI score0.00346EPSS
SaveExploits0References4
Cvelist
Cvelist
added 6 days ago28 views

CVE-2026-73285 RustFS: OPA policy plugin omits ExistingObjectTag conditions, allowing tag-based authorization policies to treat tagged objects as untagged

RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by RUSTFSPOLICYPLUGINURL in crates/iam/src/sys.rs sets PreparedIamAuth.needsexistingobjecttag incorrectly for PreparedIamMode::Opa, causing...

7.5CVSS0.00346EPSS
SaveExploits0References4
CVE
CVE
added 6 days ago29 views

CVE-2026-73284

RustFS is vulnerable in the AddServiceAccount handler (rustfs/src/admin/handlers/service_account.rs), where an attacker-controlled target_user is accepted after only validating CreateServiceAccountAdminAction, leading to the root-parent service account being marked as is_owner. This could enable ...

8.8CVSS5.3AI score0.00283EPSS
SaveExploits0References4
Rows per page
Query Builder