5963 matches found
EUVD-2026-85774
SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret tokenizer::jwt::secret, set via SIGNOZTOKENIZERJWTSECRET or the deprecated SIGNOZJWTSECRET to an empty string, and Config.Validate does not reject the empty value, so a deployment that does not configure a secret starts ...
CVE-2026-97055 SigNoz before 0.143.0 Authentication Bypass via Empty JWT Secret
SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret tokenizer::jwt::secret, set via SIGNOZTOKENIZERJWTSECRET or the deprecated SIGNOZJWTSECRET to an empty string, and Config.Validate does not reject the empty value, so a deployment that does not configure a secret starts ...
CVE-2026-97055 SigNoz before 0.143.0 Authentication Bypass via Empty JWT Secret
SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret tokenizer::jwt::secret, set via SIGNOZTOKENIZERJWTSECRET or the deprecated SIGNOZJWTSECRET to an empty string, and Config.Validate does not reject the empty value, so a deployment that does not configure a secret starts ...
CVE-2026-97055 SigNoz before 0.143.0 Authentication Bypass via Empty JWT Secret
SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret tokenizer::jwt::secret, set via SIGNOZTOKENIZERJWTSECRET or the deprecated SIGNOZJWTSECRET to an empty string, and Config.Validate does not reject the empty value, so a deployment that does not configure a secret starts ...
CVE-2026-97055: Initialization of a Resource with an Insecure Default
SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret tokenizer::jwt::secret, set via SIGNOZTOKENIZERJWTSECRET or the deprecated SIGNOZJWTSECRET to an empty string, and Config.Validate does not reject the empty value, so a deployment that does not configure a secret starts ...
PT-2026-97964
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA/bnxt re component where destroy callbacks zero the udata output after driver resources are torn down. If userspace access fails, uverbs preserves the uobject...
GHSA-PHG3-3G28-WQ9V Hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState
Summary Hatchet version v0.86.26 and below is vulnerable to OAuth state CSRF login CSRF / account fixation. The vulnerable code clears the session oauthstate value to the empty string "" after a successful OAuth callback rather than removing the key, and the subsequent state-equality check then...
EUVD-2026-83978
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauthstate session value to an empty string after a successful OAuth callback and later accepts an empty state parameter as equal, allowing an...
CVE-2026-61687 hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauthstate session value to an empty string after a successful OAuth callback and later accepts an empty state parameter as equal, allowing an...
CVE-2026-61687
Hatchet , a platform for orchestrating background tasks, AI agents, and durable workflows, contains an unauthenticated OAuth state CSRF / login-CSRF vulnerability in its ValidateOAuthState function (prior to 0.91.1 ). After a successful OAuth callback, the function clears the oauth_state_ session...
Debian dla-4787 : ruby-jwt - security update
The remote Debian 12 host has a package installed that is affected by a vulnerability as referenced in the dla-4787 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4787-1 [email protected] https://www.debian.org/lts/security/...
[SECURITY] [DLA 4787-1] ruby-jwt security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-4787-1 [email protected] https://www.debian.org/lts/security/ Abhijith PA September 18, 2026 https://wiki.debian.org/LTS -...
CVE-2026-77820
The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all versions up to, and including, 2.9.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...
CVE-2026-77820 WPComplete <= 2.9.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'empty' Shortcode Attribute
The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all versions up to, and including, 2.9.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...
EUVD-2026-83465
The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all versions up to, and including, 2.9.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...
CVE-2026-77820 WPComplete <= 2.9.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'empty' Shortcode Attribute
The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all versions up to, and including, 2.9.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...
CVE-2026-77820
WPComplete is a WordPress plugin vulnerable to Stored Cross-Site Scripting (XSS) via the 'empty' Shortcode Attribute in all versions up to and including 2.9.9.0 . The root cause is insufficient input sanitization and output escaping . Attackers with contributor-level access or higher can inject a...
PT-2026-95733
Name of the Vulnerable Software and Affected Versions WPComplete versions prior to 2.9.9.1 Description The pro version of the WPComplete plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs due to insufficient input sanitization and output escaping when handling the empt...
CVE-2026-84398
CM2507 IP cameras accept an empty password for a privileged account exposed through its ONVIF management service. An attacker with network access to the affected device could access privileged management functions and obtain device, user, media-profile, and stream configuration information...
CVE-2026-84398 CareCam CM2507 Empty Password in Configuration File
CM2507 IP cameras accept an empty password for a privileged account exposed through its ONVIF management service. An attacker with network access to the affected device could access privileged management functions and obtain device, user, media-profile, and stream configuration information...