14386 matches found
GHSA-WXPP-56Q6-5PCG vulnerabilities
Vulnerabilities for packages: zipkin, apache-nifi-registry, keycloak-config-cli...
GHSA-9F52-RJQV-25QV vulnerabilities
Vulnerabilities for packages: keycloak-config-cli, apache-nifi-registry, apache-activemq, zipkin, jenkins, apache-camel-karavan-devmode, kafbat-ui-fips, kafbat-ui, camunda-zeebe, camunda, apache-activemq-fips...
CVE-2026-41851 vulnerabilities
Vulnerabilities for packages: keycloak-config-cli, apache-nifi-registry, apache-activemq, zipkin, jenkins, apache-camel-karavan-devmode, kafbat-ui-fips, kafbat-ui, camunda-zeebe, camunda, apache-activemq-fips...
CVE-2026-41852 vulnerabilities
Vulnerabilities for packages: keycloak-config-cli, apache-nifi-registry, apache-activemq, zipkin, jenkins, apache-camel-karavan-devmode, kafbat-ui-fips, kafbat-ui, camunda-zeebe, camunda, apache-activemq-fips...
CVE-2026-41848 vulnerabilities
Vulnerabilities for packages: keycloak-config-cli, apache-nifi-registry, apache-activemq, zipkin, jenkins, apache-camel-karavan-devmode, kafbat-ui-fips, kafbat-ui, camunda-zeebe, camunda, apache-activemq-fips...
CVE-2026-41850 vulnerabilities
Vulnerabilities for packages: keycloak-config-cli, apache-nifi-registry, apache-activemq, zipkin, jenkins, apache-camel-karavan-devmode, kafbat-ui-fips, kafbat-ui, camunda-zeebe, camunda, apache-activemq-fips...
GHSA-R5W3-XV2F-J59Q vulnerabilities
Vulnerabilities for packages: keycloak-config-cli, apache-nifi-registry, apache-activemq, zipkin, jenkins, apache-camel-karavan-devmode, kafbat-ui-fips, kafbat-ui, camunda-zeebe, camunda, apache-activemq-fips...
GHSA-WXPP-56Q6-5PCG vulnerabilities
Vulnerabilities for packages: keycloak-config-cli, apache-nifi-registry, apache-activemq, zipkin, jenkins, apache-camel-karavan-devmode, kafbat-ui-fips, kafbat-ui, camunda-zeebe, camunda, apache-activemq-fips...
NPM: Jodit has prototype pollution via Jodit.configure() / ConfigMerge
NPM: Jodit has prototype pollution via Jodit.configure / ConfigMerge vulnerability discovered by ? in WordPress Npm jodit versions 4.12.18...
Jodit has prototype pollution via Jodit.configure() / ConfigMerge
Summary Jodit.configureoptions — and the internal ConfigMerge / ConfigProto helpers — merged user-supplied options into the editor configuration without filtering prototype-mutating keys. A payload nested under an existing plain-object option such as controls could reach and mutate Object.prototy...
Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot
Summary The ALLOWEDSOURCES configuration is meant to restrict which hosts Thumbor's HTTP loader may fetch images from. Plain-string entries in that list the overwhelming majority of real-world and documented configurations are passed directly to re.match without escaping. Because . is a regex...
SUSE CVE-2026-11770
A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean...
SUSE CVE-2026-41874
Quick.Cart stores hard-coded, plaintext admin credentials in a configuration file. This flaw allows attackers with access to the server file system to retrieve authentication details, potentially leading to privilege escalation. The vendor assessed the likelihood of exploitation as very low and...
CVE-2026-10686
Zephyr's IPv6 forwarding path re-sent routed unicast packets without ever decrementing the IPv6 hop limit. Both routing branches of ipv6routepacket subsys/net/ip were affected: the explicit-route path netroutepacket and the on-link cross-interface path netroutepacketif. Each set the packet...
CVE-2026-52855 Wings exposes node configuration secrets through egg configuration-file templating
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, config. placeholders in egg configuration-file templates allow a low-privileged user to read config.token, config.tokenid, and config.docker.registries from the full daemon...
CVE-2026-52855
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, config. placeholders in egg configuration-file templates allow a low-privileged user to read config.token, config.tokenid, and config.docker.registries from the full daemon...
Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM
Summary Config file parsers, json, yaml, xml etc in parser.go have no file size limit/checks, allowing for a giant config file to potentially OOM the wings process. Impact All wings users who have an egg with a non-file parser configuration file setting...
GHSA-Q6HH-GP44-4HCM Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM
Summary Config file parsers, json, yaml, xml etc in parser.go have no file size limit/checks, allowing for a giant config file to potentially OOM the wings process. Impact All wings users who have an egg with a non-file parser configuration file setting...
EUVD-2026-51567
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, unbounded json, yaml, and xml configuration-file parsers in parser.go can process an oversized non-file parser configuration file and exhaust Wings process memory. This issue is...
CVE-2026-52857 Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, unbounded json, yaml, and xml configuration-file parsers in parser.go can process an oversized non-file parser configuration file and exhaust Wings process memory. This issue is...