1244833 matches found
PT-2026-87437
Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...
AlmaLinux 10 : skopeo (ALSA-2026:64818)
The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:64818 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 encoding/asn1: golang: Go encoding/asn1: Denial of...
ALSA-2026:64772 Important: xmlrpc-c security update
XML-RPC is a remote procedure call RPC protocol that uses XML to encode its calls and HTTP as a transport mechanism. The xmlrpc-c packages provide a network protocol to allow a client program to make a simple RPC remote procedure call over the Internet. It converts an RPC into an XML document,...
RHEL 10 : buildah (RHSA-2026:64777)
The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:64777 advisory. The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a...
RHEL 10 : opentelemetry-collector (RHSA-2026:65116)
The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:65116 advisory. Collector with the supported components for a Red Hat build of OpenTelemetry Security Fixes: net/mail: golang: net/mail: Denial of Service...
RHEL 8 : xmlrpc-c (RHSA-2026:64772)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:64772 advisory. XML-RPC is a remote procedure call RPC protocol that uses XML to encode its calls and HTTP as a transport mechanism. The xmlrpc-c packages provide a...
CVE-2026-82755
ash_authentication_oauth2_server (ash-project, versions 0.1.3 through before 0.3.1) suffers from a cache-poisoning issue in its RFC 8414 / RFC 9728 metadata endpoints (AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter). When a tenant is derived from a header or Host value rather than the URL,...
CVE-2026-82755 ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion
Use of Cache Containing Sensitive Information vulnerability in ash-project ashauthenticationoauth2server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients. The RFC 8414 and RFC 9728 metadata endpoints in...
CVE-2026-82755 ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion
Use of Cache Containing Sensitive Information vulnerability in ash-project ashauthenticationoauth2server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients. The RFC 8414 and RFC 9728 metadata endpoints in...
EEF-CVE-2026-82755 ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion
Summary Use of Cache Containing Sensitive Information vulnerability in ash-project ashauthenticationoauth2server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients. The RFC 8414 and RFC 9728 metadata endpoints in...
CVE-2026-82755 ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion
Use of Cache Containing Sensitive Information vulnerability in ash-project ashauthenticationoauth2server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients. The RFC 8414 and RFC 9728 metadata endpoints in...
CVE-2026-86489
In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders across organizations...
CVE-2026-86492
In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens...
CVE-2026-86492
In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens...
CVE-2026-86492
JetBrains YouTrack versions before 2026.2.18634 are affected by a vulnerability in a shared token cache that permits cross-tenant theft of GitHub App installation tokens . An attacker with low privileges over the network (no user interaction required) can steal tokens belonging to other tenants, ...
CVE-2026-86492
In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens...
EUVD-2026-72508
In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens...
EUVD-2026-72505
In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders across organizations...
CVE-2026-86489
JetBrains YouTrack before version 2026.2.18634 contains an IDOR (Insecure Direct Object Reference) vulnerability in the user profile API , allowing an attacker with low-level privileges to disclose private issues and starred folders across organizations via the network. The CVSS 3.1 score is 6.5 ...