Lucene search
+L

5531 matches found

Cvelist
Cvelist
•added 2026/08/28 4:18 p.m.•39 views

CVE-2026-82274 Twenty Open Redirect via OAuth Propagator Callback

Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL. Attackers can craft malicious requests to redirect users to arbitrary hosts while forwarding OAuth authorization...

5.3CVSS0.00279EPSS
SaveExploits0References4
EUVD
EUVD
•added 2026/08/28 4:18 p.m.•18 views

EUVD-2026-67805

Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL. Attackers can craft malicious requests to redirect users to arbitrary hosts while forwarding OAuth authorization...

5.3CVSS5.9AI score0.00279EPSS
SaveExploits0References4
CVE
CVE
•added 2026/08/28 4:18 p.m.•23 views

CVE-2026-82274

Twenty through version 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint. The root cause is that the state query parameter is treated as a redirect URL, allowing attackers to craft malicious requests that redirect users to arbitrary ho...

5.3CVSS5.9AI score0.00279EPSS
SaveExploits0References4
OSV
OSV
•added 2026/08/28 4:18 p.m.•17 views

CVE-2026-82274 Twenty Open Redirect via OAuth Propagator Callback

Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL. Attackers can craft malicious requests to redirect users to arbitrary hosts while forwarding OAuth authorization...

5.3CVSS5.9AI score
SaveExploits0References6
CVE
CVE
•added 2026/08/28 4:18 p.m.•19 views

CVE-2026-82273

Mastra through 1.63.0 contains an authentication bypass in the memory API thread ownership validation. When the mapUserToResourceId callback is omitted from configuration, the ownership check becomes a no-op, allowing any authenticated user to enumerate all threads via GET /api/memory/threads and...

7.1CVSS5.9AI score0.00384EPSS
SaveExploits0References4
Cvelist
Cvelist
•added 2026/08/28 4:18 p.m.•38 views

CVE-2026-82273 Mastra Memory API Thread Ownership Check Is a No-op When mapUserToResourceId Is Unset

Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId callback is omitted from configuration. Authenticated attackers can enumerate all threads via GET /api/memory/threads and read conversation history and...

7.1CVSS0.00384EPSS
SaveExploits0References4
Vulnrichment
Vulnrichment
•added 2026/08/28 4:18 p.m.•39 views

CVE-2026-82273 Mastra Memory API Thread Ownership Check Is a No-op When mapUserToResourceId Is Unset

Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId callback is omitted from configuration. Authenticated attackers can enumerate all threads via GET /api/memory/threads and read conversation history and...

7.1CVSS5.9AI score0.00384EPSS
SaveExploits0References4
EUVD
EUVD
•added 2026/08/28 4:18 p.m.•18 views

EUVD-2026-67804

Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId callback is omitted from configuration. Authenticated attackers can enumerate all threads via GET /api/memory/threads and read conversation history and...

7.1CVSS5.9AI score0.00384EPSS
SaveExploits0References4
NVD
NVD
•added 2026/08/28 4:18 p.m.•15 views

CVE-2026-56854

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...

7.5CVSS0.00437EPSS
SaveExploits0References3
UbuntuCve
UbuntuCve
•added 2026/08/28 4:18 p.m.•13 views

CVE-2026-56854

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...

7.5CVSS6AI score0.00437EPSS
SaveExploits0References5
OSV
OSV
•added 2026/08/28 4:18 p.m.•9 views

UBUNTU-CVE-2026-56854

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...

7.5CVSS6AI score0.00437EPSS
SaveExploits0References6
Cvelist
Cvelist
•added 2026/08/28 3:14 p.m.•110 views

CVE-2026-56854 Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...

0.00437EPSS
SaveExploits0References3
CVE
CVE
•added 2026/08/28 3:14 p.m.•211 views

CVE-2026-56854

The golang.org/x/crypto package is affected by a vulnerability where source-address restrictions in the Permissions returned by certain authentication callbacks were silently ignored. Specifically, the source-address critical option was only enforced for PublicKeyCallback and VerifiedPublicKeyCal...

5.9AI score0.00437EPSS
SaveExploits0References3
EUVD
EUVD
•added 2026/08/28 3:14 p.m.•12 views

EUVD-2026-67741

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...

7.5CVSS5.9AI score0.00437EPSS
SaveExploits0References3
Snyk
Snyk
•added 2026/08/28 2:47 p.m.•12 views

Incorrect Authorization

Overview golang.org/x/crypto/ssh is a SSH client and server Affected versions of this package are vulnerable to Incorrect Authorization in NewServerConn, which applied the critical option from the Permissions returned by an authentication callback only on the PublicKeyCallback and...

8.1CVSS6AI score0.00602EPSS
SaveExploits0References3
OSV
OSV
•added 2026/08/28 2:47 p.m.•12 views

GO-2026-6303 Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...

5.9AI score0.00437EPSS
SaveExploits0References2
OSV
OSV
•added 2026/08/28 8:16 a.m.•10 views

AZL-98129 CVE-2026-80722 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate individual TWT params before driver setup ieee80211processrxtwtaction only partially validates a received S1G TWT setup frame before queueing it. An individual agreement can therefore reach...

8.8CVSS5.8AI score0.00403EPSS
SaveExploits0References1
NVD
NVD
•added 2026/08/28 8:16 a.m.•19 views

CVE-2026-80698

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix double free of wq, engine, and group structs The release callbacks for wq, engine, and group devices idxdconfwqrelease, idxdconfenginerelease, idxdconfgrouprelease each call kfree on the enclosing struct. The...

0.00198EPSS
SaveExploits0References2
OSV
OSV
•added 2026/08/28 8:16 a.m.•11 views

AZL-98153 CVE-2026-80698 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix double free of wq, engine, and group structs The release callbacks for wq, engine, and group devices idxdconfwqrelease, idxdconfenginerelease, idxdconfgrouprelease each call kfree on the enclosing struct. The...

6AI score0.00198EPSS
SaveExploits0References1
NVD
NVD
•added 2026/08/28 8:16 a.m.•13 views

CVE-2026-80680

In the Linux kernel, the following vulnerability has been resolved: i2c: amd-mp2: Unregister callback on adapter add failure amdmp2registercb stores the platform I2C context in the MP2 PCI driver's callback table before the adapter is registered. If i2caddadapter fails, probe returns and devres...

7.8CVSS0.00176EPSS
SaveExploits0References8
Rows per page
Query Builder