23367 matches found
PT-2026-72736
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci: validate codec capability element length Read Local Codec Capabilities returns a sequence of capability elements. Each element starts with a one-byte length followed by that many payload bytes. hci read codec...
CVE-2026-19871
CVE-2026-19871 affects Roskus Prospero Flow CRM prior to version 5.15.9. The root cause is use of hard-coded credentials where the employee save controller falls back to the literal password “changeme” and the onboarding form lacks a password field, enabling unauthenticated remote attackers who k...
CVE-2026-72828
Grav Plugin API getgrav/grav-plugin-api before 1.0.13 fails to enforce API-key scope caps in InvitationsController. The strip-super and accept-groups decisions are gated on a bare isSuperAdmin check rather than a scope-aware permission check, so a least-privilege API key scoped to api.users.write...
CVE-2026-72828
Grav Plugin API before 1.0.13 (grav-plugin-api) is affected by CVE-2026-72828: InvitationsController fails to enforce API-key scope caps. strip-super and accept-groups checks rely on isSuperAdmin() instead of scope-aware permissions, allowing a least-privilege API key scoped to api.users.write (i...
EUVD-2026-58638
The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API key scope-cap bypass in PagesController::guardTwigContent. The Twig-toggle check uses a bare isSuperAdmin gate that does not consult apikeyscopes, so a least-privilege API key scoped only to api.pages.write and minted on a...
CVE-2026-72823 Grav before 1.0.13 API-key scope cap bypass via DemoController
The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API-key scope cap bypass in DemoController. Its private requireSuper method checks isSuperAdmin and returns early before invoking requirePermission, so the apikeyscopes cap enforced only in requirePermission is skipped. As a...
CVE-2026-72823
The Grav API plugin (getgrav/grav-plugin-api) prior to 1.0.13 is impacted. Its DemoController contains a private requireSuper() check for isSuperAdmin() that returns early and skips requirePermission(), bypassing the api_key_scopes enforcement. Consequently, a scoped API key minted on a super acc...
Incorrect Authorization
org.springframework.graphql:spring-graphql is vulnerable to Improper Authorization. The vulnerability is due to incorrect resolution of security annotations on @Controller data fetcher methods within type hierarchies, which allows an attacker to bypass authorization checks when security annotatio...
GO-2023-1842 vulnerabilities
Vulnerabilities for packages: kind, kubeflow-katib, policy-controller...
GO-2023-1840 vulnerabilities
Vulnerabilities for packages: kind, kubeflow-katib, policy-controller...
GO-2023-1839 vulnerabilities
Vulnerabilities for packages: kind, kubeflow-katib, policy-controller...
GO-2023-1841 vulnerabilities
Vulnerabilities for packages: kind, kubeflow-katib, policy-controller...
GO-2025-3564 vulnerabilities
Vulnerabilities for packages: ingress-nginx-controller-fips, ingress-nginx-controller...
GO-2026-4419 vulnerabilities
Vulnerabilities for packages: ingress-nginx-controller-fips, ingress-nginx-controller...
GO-2024-2428 vulnerabilities
Vulnerabilities for packages: ingress-nginx-controller-fips, ingress-nginx-controller...
GO-2026-4423 vulnerabilities
Vulnerabilities for packages: ingress-nginx-controller-fips, ingress-nginx-controller...
GO-2025-3566 vulnerabilities
Vulnerabilities for packages: ingress-nginx-controller-fips, ingress-nginx-controller...
GO-2025-3567 vulnerabilities
Vulnerabilities for packages: ingress-nginx-controller-fips, ingress-nginx-controller...