25991 matches found
EUVD-2026-101122
Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAuth IdP and allow an attacker to acquire unauthenticated access to protected paths before the proper external...
CVE-2026-104939 NGINX Ingress Controller vulnerability
Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAuth IdP and allow an attacker to acquire unauthenticated access to protected paths before the proper external...
CVE-2026-94197 NGINX Ingress Controller vulnerability
An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller NIC when configured with the ExternalAuth policy or Ingress external authentication. Client-supplied X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method routing and...
CVE-2026-94197
An authentication and authorization bypass vulnerability exists in the F5 NGINX Ingress Controller when configured with the ExternalAuth policy or Ingress external authentication. The root cause is the unsanitized forwarding of client-supplied headers, specifically X-Forwarded-Prefix , X-Forwarde...
EUVD-2026-101118
An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller NIC when configured with the ExternalAuth policy or Ingress external authentication. Client-supplied X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method routing and...
K000162617: NGINX Ingress Controller vulnerability CVE-2026-104939
Security Advisory Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAuth IdP and allow an attacker to acquire unauthenticated access to protected paths before the proper...
K000162611: NGINX Ingress Controller vulnerability CVE-2026-94197
Security Advisory Description An authentication and authorization bypass vulnerability exists in F5 NGINX Ingress Controller when configured with the ExternalAuth policy or with Ingress external authentication. Client-supplied X-Forwarded-Prefix , X-Forwarded-URI , X-Original-URI , and...
PT-2026-113998
Name of the Vulnerable Software and Affected Versions Omada Controller affected versions not specified Description Improper administrative authorization in the MSP and OpenAPI certificate and private-key management APIs allows an authenticated user to perform privileged operations. A low-privileg...
CVE-2026-107795: Missing Authorization
Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing an authenticated user to perform privileged certificate management operations. Successful exploitation may allow a low-privileged authenticated user to upload...
CVE-2026-104939: Incorrect Implementation of Authentication Algorithm
Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAuth IdP and allow an attacker to acquire unauthenticated access to protected paths before the proper external...
CVE-2026-102298: Authorization Bypass Through User-Controlled Key
In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check. An authenticated user can supply a caller-controlled Identifier parameter to validate credentials for another account and receive responses that distinguish nonexistent users, invalid...
PT-2026-114352
Name of the Vulnerable Software and Affected Versions F5 NGINX Kubernetes Ingress Controller versions 5.5.0 through 5.6.x Description An authentication and authorization bypass exists when the system is configured with the ExternalAuth policy or Ingress external authentication. The controller...
CVE-2026-94197: Authentication Bypass by Spoofing
An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller NIC when configured with the ExternalAuth policy or Ingress external authentication. Client-supplied X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method routing and...
CVE-2026-53999: Improper Input Validation
Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps. Prior to 0.58.0, the Kubernetes controller deserializes the user-controlled radapp.io/status annotation on a Deployment and uses its container resource identifier for...
PT-2026-113935
Name of the Vulnerable Software and Affected Versions Omada Controller affected versions not specified Description In MSP mode, the user-confirmation endpoint fails to enforce necessary permission checks. An authenticated user can provide a caller-controlled Identifier parameter to validate...
Ubuntu 24.04 LTS : Linux kernel (OEM) vulnerabilities (USN-8911-1)
The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8911-1 advisory. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in...
CVE-2026-100706
A flaw was found in Kyverno. An authenticated user with namespace-level permissions can achieve privilege escalation to cluster administrator by supplying encoded path traversal sequences within policy requests. This vulnerability allows an attacker to bypass namespace isolation controls and crea...
CVE-2026-63148
The Omnispace Agora Project (versions before 26.10.0 ) is vulnerable to a stored cross-site scripting (XSS) flaw. Authenticated attackers can bypass the paramFilter sanitization applied to ** extsubscript{$_FILES}** by uploading a poll-response attachment with a malicious filename. This crafted f...
CVE-2023-35793-CSRF-On-Web-SSH
CVE-2023-35793-CSRF-On-Web-SSH Repository contains description for CVE-2023-35793 discovered by Dodge Industrial Team for Dodge OPTIFY platfrom. CVE ID: CVE-2023-35793 Vendor: Cassia Networks Product: Access Controller Version: Cassia-AC-2.1.1.2303271039 Vulnerability: Cross Site Request Forgery...
