uptime-kuma-setup-toctou

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · uptime-kuma-setup-toctou Write-up: https://abraxaslabs.tech/research/uptime-kuma-setup-toctou uptime-kuma-setup-toctou Uptime Kuma 2.5.5 - Louis Lam First-run Socket.IO setup COUNTs users, bcrypts at cost 10, then...

Security Advisory 0169

Security Advisory 0169 . CSAF PDF Date: September 9, 2026 Revision | Date | Changes ---|---|--- 1.0 | September 9, 2026 | Initial release 1.1 | September 22, 2026 | CSAF JSON file added The CVE-ID tracking this issue: CVE-2026-73463 CVSSv3.1 Base Score: 5.3...

CVE-2026-10722 vulnerabilities

Vulnerabilities for packages: witness, docker-fips, kubescape-operator-fips, vitess, kubescape-server, beats, agentbeat-fips, cilium-fips, nerdctl-fips, kubescape, falcoctl, opentelemetry-ebpf-instrumentation-fips, hubble, milvus, elastic-agent, containerd, agentbeat, rke2-runtime,...

Linux IPv6 Protocol Heap Buffer Overflow DoS

The vulnerability of the fib6addrt2node function in the net/ipv6/ip6fib.c module of the Linux operating system’s IPv6 kernel implementation is related to state management errors. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility ...

CVE-2026-13197

Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in the configuration and process-image management functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker to...

CVE-2026-13198

Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in the event notification functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker to corrupt kernel heap and...

CVE-2026-13198 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in KUNBUS piControl

Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in the event notification functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker to corrupt kernel heap and...

EUVD-2026-58675

Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in the event notification functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker to corrupt kernel heap and...

CVE-2026-13198

CVE-2026-13198 affects KUNBUS piControl (version 2.6.2) with a race condition in the event-notification path. Nozomi Networks reports CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization, enabling a local authenticated attacker to corrupt kernel heap and event-list st...

CVE-2026-13198 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in KUNBUS piControl

Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in the event notification functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker to corrupt kernel heap and...

CVE-2026-13198

Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in the event notification functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker to corrupt kernel heap and...

CVE-2026-13197

Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in the configuration and process-image management functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker to...

CVE-2026-13197 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in KUNBUS piControl

Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in the configuration and process-image management functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker to...

CVE-2026-13197 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in KUNBUS piControl

Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in the configuration and process-image management functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker to...

CVE-2026-13197

KUNBUS piControl (version 2.6.2) is affected by a CWE-362 race condition in its configuration and process-image management. The issue arises from concurrent requests to the piControl character device, allowing a local authenticated attacker to trigger use-after-free and invalid pointer dereferenc...

GO-2026-5213 vulnerabilities

Vulnerabilities for packages: openbao...

PT-2026-72033

Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in the event notification functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker to corrupt kernel heap and...

PT-2026-72032

Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in the configuration and process-image management functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker to...

WeKan OIDC login callback shares serviceData/profile, enabling concurrent account takeover (regression hardening)

WeKan OIDC Login Callback Shares Login Context, Enabling Concurrent Account Takeover Regression Hardening Vulnerability Overview In WeKan's OIDC OAuth2/OIDC login flow, the per-login identity context objects were once placed in a shared scope outside the login callback, so multiple concurrent OID...

WeKan CAS login shares module-level global user data, enabling concurrent account takeover (CasBleed)

WeKan CAS Login Shares Module-Level Global User Data, Enabling Concurrent Account Takeover CasBleed Vulnerability Overview WeKan's CAS single sign-on implementation contains a concurrent race condition flaw: the user identity data returned by the CAS server after ticket validation is stored in a...