135251 matches found
CVE-2026-52880 Klever-Go: REST API slow-header connection exhaustion via Gin Engine.Run
Klever-Go is the Go implementation of the Klever blockchain protocol. Versions from 1.7.14 through 1.7.17 are vulnerable to a remotely triggerable denial of service. Both REST APIs are started with the Gin Engine.Run convenience method, which serves requests through Go's default HTTP server with ...
CVE-2026-52880 Klever-Go: REST API slow-header connection exhaustion via Gin Engine.Run
Klever-Go is the Go implementation of the Klever blockchain protocol. Versions from 1.7.14 through 1.7.17 are vulnerable to a remotely triggerable denial of service. Both REST APIs are started with the Gin Engine.Run convenience method, which serves requests through Go's default HTTP server with ...
CVE-2026-52880
Klever-Go REST API (seednode and node) in versions 1.7.14β1.7.17 is affected by a denial-of-service via slow-header connections. The issue stems from Gin Engine.Run using Goβs default http.ListenAndServe with no ReadHeaderTimeout, ReadTimeout, or MaxHeaderBytes, allowing an unauthenticated client...
CVE-2026-52880 Klever-Go: REST API slow-header connection exhaustion via Gin Engine.Run
Klever-Go is the Go implementation of the Klever blockchain protocol. Versions from 1.7.14 through 1.7.17 are vulnerable to a remotely triggerable denial of service. Both REST APIs are started with the Gin Engine.Run convenience method, which serves requests through Go's default HTTP server with ...
nono v0.72.0
Built by the team that brought you Sigstore The standard for secure software attestation, used by PyPI, npm, brew, and Maven Central !NOTE In the lead-up to a 1.0 release, APIs are stabilizing. API changes may still occur where necessary, but will be kept to a minimum. !IMPORTANT Organization...
CVE-2026-46405
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, in OpenBao's Kerberos auth method on the GET handler, or when an Authorization: Negotiate header is supplied, the response is includes a logical.Auth object in addition to an error message. This results in...
CVE-2026-46405
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, in OpenBao's Kerberos auth method on the GET handler, or when an Authorization: Negotiate header is supplied, the response is includes a logical.Auth object in addition to an error message. This results in...
CVE-2026-46405 OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, in OpenBao's Kerberos auth method on the GET handler, or when an Authorization: Negotiate header is supplied, the response is includes a logical.Auth object in addition to an error message. This results in...
CVE-2026-46405 OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, in OpenBao's Kerberos auth method on the GET handler, or when an Authorization: Negotiate header is supplied, the response is includes a logical.Auth object in addition to an error message. This results in...
CVE-2026-46405
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, in OpenBao's Kerberos auth method on the GET handler, or when an Authorization: Negotiate header is supplied, the response is includes a logical.Auth object in addition to an error message. This results in...
CVE-2026-46405 OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, in OpenBao's Kerberos auth method on the GET handler, or when an Authorization: Negotiate header is supplied, the response is includes a logical.Auth object in addition to an error message. This results in...
CVE-2026-46405
OpenBao's CVE-2026-46405 affects the Kerberos auth method in OpenBao prior to v2.5.4. The GET handler (and requests with Authorization: Negotiate) can cause the system to return a response that includes a hidden logical.Auth token alongside an error, resulting in tokens created with default polic...
EUVD-2026-54683
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, in OpenBao's Kerberos auth method on the GET handler, or when an Authorization: Negotiate header is supplied, the response is includes a logical.Auth object in addition to an error message. This results in...
vigolium v0.3.10
Vigolium - High-fidelity vulnerability scanner fusing agentic AI with native speed, modularity, and precision Vigolium provides two complementary scanning modes: Native Scan vigolium scan: Fast, powerful, and flexible. Deterministic, multi-phase scanning with 317 modules across content discovery,...
Security Bulletin: Consul vulnerable to partial arbitrary file read via Vault Connect CA provider
Summary Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect CA provider with JWT or AppRole authentication. A privileged attacker with operator:write permission may direct Consul to read and...
xalgorix v4.5.125
Xalgorix β Open-source AI pentester that proves vulnerabilities Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported β so you get proof, not a pile of maybes to triage...
yakit v1.4.8-0807
YAKIT-A Cyber Security ALL-IN-ONE Platform based on Yak language Whitepaper β’ Official documentation β’ Issue feedback β’ Official website β’ Community β’ Architecture :book:LanguageοΌ English β’ δΈζ Introduction Security integration is a reform of security operations and management for enterprises in t...
JLSEC-2026-1204 libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated...
libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTPS request after a Negotiate-authenticated one, when both use the same host. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid...
Atlassian Jira Limited - Local File Inclusion
Affected versions of Atlassian Jira Limited Server and Data Center are vulnerable to local file inclusion because they allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. id: CVE-2021-26086 info: name: Atlassian Jira Limited - Local...
Deserialization of Untrusted Data
Overview zenml is a ZenML: Write production-ready ML code. Affected versions of this package are vulnerable to Deserialization of Untrusted Data through the cloudpickle.load process in cloudpicklematerializer.py. An attacker can execute arbitrary system commands by placing a malicious pickle file...