cvelistV5

ملاحظة 2026-2-17 إضافة يوم معالجة إضافي لتوحيد التاريخ لمعالجة التناقضات المحتملة جدول توحيد التاريخ الجديد: 2/16/26 - 2/28/26 ملاحظة 2026-2-10 تغيير ملفdeltaLog.json الخاص بتوحيد تاريخ السجلات يحتفظ ملف deltaLog.json عادةً بسجل متجدد من تاريخ تعديل سجلات CVE يعود إلى 30 يومًا. ومع ذلك، وطوال فتر...

CVE-2026-59178

ESPHome Device Builder Dashboard prior to version 1.0.12 silently loses dashboard authentication after an upgrade. The root cause is that authentication credentials were read from $USERNAME/$PASSWORD in earlier versions, but after being renamed to $ESPHOME_USERNAME/$ESPHOME_PASSWORD, the bare nam...

cvelistV5 cve_2026-08-20_0000Z

Note 2026-2-17 Adding Additional day of processing for date normalization to addreess potential inconsistencies New Date Normalization schedule: 2/16/26 - 2/28/26 Note 2026-2-10 Record Date NormalizationdeltaLog.json file change The deltaLog.json file normally retains a rolling 30 days worth of C...

cvelistV5 cve_2026-08-06_1000Z

Note 2026-2-17 Adding Additional day of processing for date normalization to addreess potential inconsistencies New Date Normalization schedule: 2/16/26 - 2/28/26 Note 2026-2-10 Record Date NormalizationdeltaLog.json file change The deltaLog.json file normally retains a rolling 30 days worth of C...

cvelistV5 cve_2026-08-05_0000Z

Note 2026-2-17 Adding Additional day of processing for date normalization to addreess potential inconsistencies New Date Normalization schedule: 2/16/26 - 2/28/26 Note 2026-2-10 Record Date NormalizationdeltaLog.json file change The deltaLog.json file normally retains a rolling 30 days worth of C...

cvelistV5 cve_2026-08-03_0000Z

Note 2026-2-17 Adding Additional day of processing for date normalization to addreess potential inconsistencies New Date Normalization schedule: 2/16/26 - 2/28/26 Note 2026-2-10 Record Date NormalizationdeltaLog.json file change The deltaLog.json file normally retains a rolling 30 days worth of C...

cvelistV5 cve_2026-07-31_0300Z

Note 2026-2-17 Adding Additional day of processing for date normalization to addreess potential inconsistencies New Date Normalization schedule: 2/16/26 - 2/28/26 Note 2026-2-10 Record Date NormalizationdeltaLog.json file change The deltaLog.json file normally retains a rolling 30 days worth of C...

@better-auth/oauth-provider may provide access tokens for unauthorized audiences via unbound resource indicators

Am I affected? Users are affected if all of the following hold: - Their application depends on @better-auth/oauth-provider on any stable 1.6.x release the stable line is not patched or on a pre-release before 1.7.0-beta.4. - Their application either configures validAudiences with more than one...

GHSA-4C4X-JM2X-PF9J Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL

Summary /api/v1/index/retrieve supports retrieving a public key via a user-provided URL, allowing attackers to trigger SSRF to arbitrary internal services. Since the SSRF only can trigger GET requests, the request cannot mutate state. The response from the GET request is not returned to the calle...

GHSA-F67F-6CW9-8MQ4 Hono JWT Middleware's JWT Algorithm Confusion via Unsafe Default (HS256) Allows Token Forgery and Auth Bypass

Summary A flaw in Hono’s JWK/JWKS JWT verification middleware allowed the JWT header’s alg value to influence signature verification when the selected JWK did not explicitly specify an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be...

CVE-2022-31027

OAuthenticator is an OAuth token library for the JupyerHub login handler. CILogonOAuthenticator is provided by the OAuthenticator package, and lets users log in to a JupyterHub via CILogon. This is primarily used to restrict a JupyterHub only to users of a given institute. The allowedidps...

CVE-2025-13353

In gokey versions 0.2.0, a flaw in the seed decryption logic resulted in passwords incorrectly being derived solely from the initial vector and the AES-GCM authentication tag of the key seed. This issue has been fixed in gokey version 0.2.0. This is a breaking change. The fix has invalidated any...

CVE-2025-13353 gokey allows secret recovery from a seed file without the master password

In gokey versions 0.2.0, a flaw in the seed decryption logic resulted in passwords incorrectly being derived solely from the initial vector and the AES-GCM authentication tag of the key seed. This issue has been fixed in gokey version 0.2.0. This is a breaking change. The fix has invalidated any...

EUVD-2022-0169

Malicious code in bioql PyPI...

EUVD-2023-2056

Malicious code in bioql PyPI...

OESA-2025-2232 python-eventlet security update

Eventlet is a concurrent networking library for Python that allows you to change how you run your code, not how you write it. Security Fixes: Eventlet is a concurrent networking library for Python. Prior to version 0.40.3, the Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to...

Cross-site Request Forgery (CSRF)

Overview github.com/justinas/nosurf is a HTTP package for Go that helps you prevent Cross-Site Request Forgery attacks. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF due to the misuse of the net/http library. An attacker can bypass CSRF checks and issue...

Fedora 41 : rpki-client (2025-17fed14cc3)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-17fed14cc3 advisory. rpki-client 9.5 - rpki-client now includes arin.tal which is no longer legally encumbered. See https://www.arin.net/announcements/20250116-tal/ - rpki-client...

Fedora 40 : rpki-client (2025-d5fdbedb7f)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-d5fdbedb7f advisory. rpki-client 9.5 - rpki-client now includes arin.tal which is no longer legally encumbered. See https://www.arin.net/announcements/20250116-tal/ - rpki-client...

Potential Denial-of-Service condition leading to temporary disability in IBC transfers to the native chain

Impact Chains using affected versions of Packet Forward Middleware in their IBC Transfer stack are vulnerable to an attack in which there is a potential denial of service. This affects IBC transfers for any asset which is being transferred between another chain and its native chain. We recommend...