140 matches found
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization in the AuthorizeHost middleware due to incorrect validation of host JWT tokens. An attacker can gain unauthorized access to, modify, or delete resources belonging to other hosts by crafting requests that include ...
CVE-2026-29194 Netmaker: Insufficient Authorization in Host Token Verification
Netmaker makes networks with WireGuard. Prior to version 1.5.0, the Authorize middleware in Netmaker incorrectly validates host JWT tokens. When a route permits host authentication hostAllowed=true, a valid host token bypasses all subsequent authorization checks without verifying that the host is...
CVE-2026-29194
Netmaker makes networks with WireGuard. Prior to version 1.5.0, the Authorize middleware in Netmaker incorrectly validates host JWT tokens. When a route permits host authentication hostAllowed=true, a valid host token bypasses all subsequent authorization checks without verifying that the host is...
CVE-2026-29194 Netmaker: Insufficient Authorization in Host Token Verification
Netmaker makes networks with WireGuard. Prior to version 1.5.0, the Authorize middleware in Netmaker incorrectly validates host JWT tokens. When a route permits host authentication hostAllowed=true, a valid host token bypasses all subsequent authorization checks without verifying that the host is...
CVE-2026-29194
CVE-2026-29194 affects Netmaker (WireGuard-based networks). Before v1.5.0, the Authorize middleware can mishandle host JWT validation when hostAllowed=true, allowing a valid host token to bypass subsequent authorization checks without verifying host-resource authorization. An attacker with knowle...
Gravitl Netmaker security vulnerabilities
Gravitl Netmaker is a platform developed by the American company Gravitl, which uses WireGuard to create and manage fast, secure, and dynamic virtual overlay networks. It is used to create and control automated virtual networks. Versions of Gravitl Netmaker prior to 1.5.0 contained security...
CVE-2026-28677 OpenSift: Insufficient URL destination restrictions in ingest flow could enable SSRF-style internal access
OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Prior to version 1.6.3-alpha, the URL ingest pipeline accepted user-controlled remote URLs with incomplete destination restrictions. Although private/local host checks existed, missing...
CVE-2026-28677 OpenSift: Insufficient URL destination restrictions in ingest flow could enable SSRF-style internal access
OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Prior to version 1.6.3-alpha, the URL ingest pipeline accepted user-controlled remote URLs with incomplete destination restrictions. Although private/local host checks existed, missing...
EUVD-2026-9988
OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Prior to version 1.6.3-alpha, the URL ingest pipeline accepted user-controlled remote URLs with incomplete destination restrictions. Although private/local host checks existed, missing...
CVE-2026-28677 OpenSift: Insufficient URL destination restrictions in ingest flow could enable SSRF-style internal access
OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Prior to version 1.6.3-alpha, the URL ingest pipeline accepted user-controlled remote URLs with incomplete destination restrictions. Although private/local host checks existed, missing...
PT-2026-23644
Name of the Vulnerable Software and Affected Versions OpenSift versions prior to 1.6.3-alpha Description OpenSift is an AI study tool that uses semantic search and generative AI to process large datasets. The URL ingest pipeline had insufficient restrictions on user-controlled remote URLs, creati...
CVE-2026-28677: Server-Side Request Forgery (SSRF)
OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Prior to version 1.6.3-alpha, the URL ingest pipeline accepted user-controlled remote URLs with incomplete destination restrictions. Although private/local host checks existed, missing...
[SECURITY] Fedora 43 Update: munge-0.5.18-1.fc43
MUNGE MUNGE Uid 'N' Gid Emporium is an authentication service for creating and validating credentials. It is designed to be highly scalable for use in an HPC cluster environment. It allows a process to authenticate the UID and GID of another local or remote process within a group of hosts having...
UBUNTU-CVE-2026-1539
A flaw was found in the libsoup HTTP library that can cause proxy authentication credentials to be sent to unintended destinations. When handling HTTP redirects, libsoup removes the Authorization header but does not remove the Proxy-Authorization header if the request is redirected to a different...
MiracleLinux 8 : python27:2.7 (AXSA:2020-969:01)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2020-969:01 advisory. python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure CVE-2018-20060 python: Cookie domain check...
[SECURITY] Fedora 43 Update: apptainer-1.4.4-1.fc43
Apptainer provides functionality to make portable containers that can be used across host environments...
[SECURITY] Fedora 42 Update: apptainer-1.4.3-1.fc42
Apptainer provides functionality to make portable containers that can be used across host environments...
[SECURITY] Fedora 41 Update: apptainer-1.4.2-1.fc41
Apptainer provides functionality to make portable containers that can be used across host environments...
PT-2026-23868
Name of the Vulnerable Software and Affected Versions Netmaker versions prior to 1.5.0 Description Netmaker, which utilizes WireGuard, has an issue where the Authorize middleware does not properly validate host JWT tokens. When host authentication is permitted hostAllowed=true, a valid host token...
