62340 matches found
CVE-2026-47237
Kubeflow Community Distribution helps users to install Kubeflow Platform in popular Kubernetes clusters. Prior to version 26.03-rc.1, a Kubeflow setup based on the official manifests or most other packaged Kubeflow distributions is vulnerable to authorization token stealing from any user of the...
CVE-2026-16394
creationtimestamp| type| source ---|---|--- 2026-07-21 20:56:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6p2bgfsq2q 2026-07-22 04:47:20+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260722 2026-07-23 05:37:06+00:00| see...
CVE-2026-16359
creationtimestamp| type| source ---|---|--- 2026-07-21 20:56:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6p27frgc24 2026-07-22 04:45:58+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260722 2026-07-22 09:40:04+00:00| see...
CVE-2026-47237 Kubeflow Community Distribution: Overly Permissive Istio Permissions Allows Kubeflow Authorization Token Stealing
Kubeflow Community Distribution helps users to install Kubeflow Platform in popular Kubernetes clusters. Prior to version 26.03-rc.1, a Kubeflow setup based on the official manifests or most other packaged Kubeflow distributions is vulnerable to authorization token stealing from any user of the...
CVE-2026-47237 Kubeflow Community Distribution: Overly Permissive Istio Permissions Allows Kubeflow Authorization Token Stealing
Kubeflow Community Distribution helps users to install Kubeflow Platform in popular Kubernetes clusters. Prior to version 26.03-rc.1, a Kubeflow setup based on the official manifests or most other packaged Kubeflow distributions is vulnerable to authorization token stealing from any user of the...
Improper Authentication
Overview Affected versions of this package are vulnerable to Improper Authentication via the CreateAccessToken process. An attacker can gain elevated privileges by supplying a restricted token in the Authorization: Basic :x-oauth-basic format, which bypasses authentication checks and allows...
GHSA-683J-3FF6-HH2X Gitea: Privilege Escalation via Access Token Scope Escalation in API
Gitea's API endpoint for creating Personal Access Tokens POST /users/username/tokens is protected by a middleware reqBasicOrRevProxyAuth that is intended to require password-based authentication, preventing a compromised token from being used to mint new ones. However, when a token is passed in t...
Gitea: Privilege Escalation via Access Token Scope Escalation in API
Gitea's API endpoint for creating Personal Access Tokens POST /users/username/tokens is protected by a middleware reqBasicOrRevProxyAuth that is intended to require password-based authentication, preventing a compromised token from being used to mint new ones. However, when a token is passed in t...
CVE-2026-64613
Data::Buffer::Shared versions before 0.05 for Perl create a world-readable mmap backing file and open it without ONOFOLLOW. The segment is created in bufgeneric.h with openpath, ORDWR|OCREAT|OEXCL, 0666. OEXCL blocks a pre-seeded file on create, but the mode is 0666, so under the default umask 02...
CVE-2026-47418
creationtimestamp| type| source ---|---|--- 2026-07-21 19:49:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr6ldd6txf27...
CVE-2026-47412
creationtimestamp| type| source ---|---|--- 2026-07-21 19:31:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr6kczhtvo2o...
CVE-2026-47419
creationtimestamp| type| source ---|---|--- 2026-07-21 19:30:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr6kb7tahr2i...
CVE-2026-16361
creationtimestamp| type| source ---|---|--- 2026-07-21 19:28:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6k4uz5j62u 2026-07-22 04:46:03+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260722 2026-07-22 23:36:04+00:00| see...
CVE-2026-65064
Data::HashMap::Shared versions before 0.14 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW. The segment is created in shmgeneric.h with openpath, ORDWR | OCREAT | OCLOEXEC, 0666. The mode is 0666, so under the default umask 022 the file is created mode 06...
CVE-2026-65061 Data::ReqRep::Shared versions before 0.05 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW
Data::ReqRep::Shared versions before 0.05 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW. The segment is created in reqrep.h with openpath, ORDWR | OCREAT, 0666, for both the request-reply and the integer-variant segments. The mode is 0666, so under the...
CVE-2026-64615 Data::Graph::Shared versions before 0.04 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW
Data::Graph::Shared versions before 0.04 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW. The segment is created in graph.h with openpath, ORDWR|OCREAT, 0666. The mode is 0666, so under the default umask 022 the file is created mode 0644 world-readable...
CVE-2026-64615
The Data::Graph::Shared Perl module (versions before 0.04 ) is vulnerable to insecure file handling. The software creates a world-readable mmap backing file using open(path, O_RDWR|O_CREAT, 0666), which results in mode 0644 under a default umask of 022. Because the call lacks O_EXCL , an attacker...
CVE-2026-15793
creationtimestamp| type| source ---|---|--- 2026-07-21 19:00:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr6im6rly627...