4936 matches found
OpenSSH: OpenSSH: Security bypass via mishandling of authorized_keys principals option
A flaw was found in OpenSSH. This vulnerability arises from the incorrect handling of the authorizedkeys principals option in uncommon scenarios. Specifically, when a principals list is used with a Certificate Authority that includes comma characters, OpenSSH may misinterpret the input. This coul...
CLSA-2026-1777465438 openssh: Fix of CVE-2026-35414
CVE-2026-35414: fix incorrect matching of the authorizedkeys principals="" option against certificate principals containing comma characters...
CLSA-2026-1777453408 Fix CVE(s): CVE-2026-35414
SECURITY UPDATE: incorrect matching of principals in the authorizedkeys principals="..." option when a certificate principal contains a comma. - debian/patches/CVE-2026-35414.patch: fix matchprincipalsoption to split on comma and compare principals exactly - CVE-2026-35414...
CVE-2026-4805
The Woostify plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.5.0 This is due to insufficient input sanitization and output escaping in the bundled Lity.js lightbox library, where user-controlled input from the href attribute is concatenated...
The vulnerability of the authorized_keys() function in the OpenSSH cryptographic protection mechanism allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the authorizedkeys function in the OpenSSH cryptographic protection mechanism is related to the improper implementation of stream control. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected...
OpenClaw 安全漏洞
OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.3.22 contained security vulnerabilities. These vulnerabilities stemmed from incomplete host environment variable cleanup mechanisms in the host-env-security-policy.json and...
CLSA-2026-1777307655 openssh: Fix of CVE-2026-35414
CVE-2026-35414: fix incorrect matching of principals in the authorizedkeys principals="..." option when a certificate principal contains a comma character...
CLSA-2026-1777296725 Fix CVE(s): CVE-2026-35414
SECURITY UPDATE: mishandling of authorizedkeys principals option - debian/patches/CVE-2026-35414.patch: replace matchlist with xstrdup + strsep + exact strcmp in matchprincipalsoption in auth2-pubkey.c, so certificate principals containing embedded commas are no longer wrongly cross-matched. -...
DarkWin-NGASR
🌌 DARKWIN — Next-Gen Automated Security Research Develope...
CVE-2026-24303
Improper access control in Microsoft Partner Center allows an authorized attacker to elevate privileges over a network...
Fedora 44 : openssh (2026-93679cc7c2)
The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-93679cc7c2 advisory. - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode - CVE-2026-35388: Add connection multiplexing...
nova-toggle-5: Improper authorization on toggle endpoint allowed non-Nova users to modify boolean fields
Impact In versions middleware. Any user authenticated on the configured guard could call the endpoint and flip boolean attributes on any Nova resource — including users who do not have access to Nova itself for example, frontend customers sharing the web guard with the Nova admin area. The endpoi...
authorized-pentest
authorized-pentest A runbook-style Claude Code skill for runn...
EUVD-2026-25303
Improper access control in Microsoft Partner Center allows an authorized attacker to elevate privileges over a network...
CVE-2026-31952
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Versions 1.7 through 4.4.0 have an SQL injection vulnerability in the API routes inside the CMS responsible for Filtering DataSets. This allows an authenticated user to to...
CVE-2026-31952
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Versions 1.7 through 4.4.0 have an SQL injection vulnerability in the API routes inside the CMS responsible for Filtering DataSets. This allows an authenticated user to to...
CVE-2026-31952 Xibo CMS API has SQL Injection via DataSet Filter Parameter
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Versions 1.7 through 4.4.0 have an SQL injection vulnerability in the API routes inside the CMS responsible for Filtering DataSets. This allows an authenticated user to to...
CVE-2026-31952
Vulnerability: CVE-2026-31952 affects Xibo CMS. Versions 1.7–4.4.0 expose an SQL injection in the API routes responsible for Filtering DataSets. An authenticated user with either the Access to DataSet Feature or Access to the Layout Feature privilege can inject crafted values to extract/modify da...
Xibo CMS SQL注入漏洞
Xibo CMS is an open-source content management system for Xibo Digital Signage. Versions 1.7 to 4.4.0 of Xibo CMS have SQL injection vulnerabilities. These vulnerabilities stem from SQL injection in the dataset filtering parameters within the API routing, which may allow authorized users to access...