62 matches found
CVE-2026-85317
Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The OAuth2 client token cache is global to the JVM, and its key omitted several of the fields that determine what a tok...
CVE-2026-85317
Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The OAuth2 client token cache is global to the JVM, and its key omitted several of the fields that determine what a tok...
EUVD-2026-104205
Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The OAuth2 client token cache is global to the JVM, and its key omitted several of the fields that determine what a tok...
PT-2026-117364
Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The OAuth2 client token cache is global to the JVM, and its key omitted several of the fields that determine what a tok...
CVE-2026-85317: Use of Cache Containing Sensitive Information
Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The OAuth2 client token cache is global to the JVM, and its key omitted several of the fields that determine what a tok...
GHSA-3HCJ-9M7P-WWM9 Gotify: Insufficiently Protected Password Change endpoint
The password change endpoint POST /current/user/password in Gotify versions = 2.9.1 does not require knowledge of the current password. An attacker in possession of a valid client token can set a new password for the affected user. Recovering the account requires administrator intervention or...
Mattermost information leakage vulnerability
Mattermost versions 11.9.1 and earlier of 11.9.x series, 11.8.5 and earlier of 11.8.x series, 11.7.10 and earlier of 11.7.x series, and 11.10.1 and earlier of 11.10.x series have a vulnerability related to information leakage. This vulnerability arises from the lack of a requirement to re-enter t...
CVE-2026-102603 Gotify: Insufficiently Protected Password Change endpoint
Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint POST /current/user/password accepts a valid client token without requiring the account's current password or another elevated authentication step. An attack...
CVE-2026-102603
The Gotify server is vulnerable to an insufficiently protected password change endpoint (POST /current/user/password) in versions prior to 3.0.0 . The software fails to require the account's current password or an elevated authentication step, accepting only a valid client token. An attacker who ...
CVE-2026-102603 Gotify: Insufficiently Protected Password Change endpoint
Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint POST /current/user/password accepts a valid client token without requiring the account's current password or another elevated authentication step. An attack...
CVE-2026-102603
Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint POST /current/user/password accepts a valid client token without requiring the account's current password or another elevated authentication step. An attack...
PT-2026-111582
Name of the Vulnerable Software and Affected Versions Gotify server versions prior to 3.0.0 Description The password change endpoint 'POST /current/user/password' allows a user to change their password using only a valid client token. It does not require the current password or any additional...
GHSA-48MH-J4P5-7J9V Parse Server missing audience validation in Keycloak authentication adapter
Impact The Keycloak authentication adapter does not validate the azp authorized party claim of Keycloak access tokens against the configured client-id. A valid access token issued by the same Keycloak realm for a different client application can be used to authenticate as any user on the Parse...
Lack of TLS certificate validation when connecting Arc to a Guardian or CMC, in Arc before v2.2.0
Summary The server certificate was not verified when an Arc agent connected to a Guardian or CMC. Impact A malicious actor could perform a man-in-the-middle attack and intercept the communication between the Arc agent and the Guardian or CMC. This could result in theft of the client token and...
GHSA-H956-RH7X-PPGJ RustFS has a gRPC Hardcoded Token Authentication Bypass
Vulnerability Overview Description RustFS implements gRPC authentication using a hardcoded static token "rustfs rpc" that is: 1. Publicly exposed in the source code repository 2. Hardcoded on both client and server sides 3. Non-configurable with no mechanism for token rotation 4. Universally vali...
EUVD-2020-26594
Malware in sbrugna...
EUVD-2020-29878
Malware in sbrugna...
EUVD-2021-10817
Malware in sbrugna...