16183 matches found
CVE-2026-13410
CVE-2026-13410 affects Dancer::Plugin::Auth::Google for Perl up to version 0.07, where TLS verification is disabled in the library and the default user agent SSL_verify_mode is turned off. This enables a network (MITM) attacker between the Dancer app and googleapis.com to intercept the OAuth2 tok...
PT-2026-60745
Dancer::Plugin::Auth::Google versions through 0.07 for Perl have TLS verification disabled. The default user agent is initialised with SSL verify mode explicitly disabled. An attacker with network man-in-the-middle MITM capability between the Dancer application and googleapis.com can intercept th...
CVE-2026-63305
creationtimestamp| type| source ---|---|--- 2026-07-16 13:30:27+00:00| seen| https://infosec.exchange/users/offseq/statuses/116929896586145034 2026-07-16 13:30:30+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mqrdssbvep2z 2026-07-16 13:44:04+00:00| seen|...
Libreswan 4.6 < 5.3.1 DoS
The version of Libreswan installed on the remote host is between 4.6 and 5.3.1 exclusive. It is, therefore, affected by a denial of service vulnerability. An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. The function reassemblev2incomingfragments would...
openSUSE 16 Security Update : libredwg (openSUSE-SU-2026:21346-1)
The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21346-1 advisory. Changes in libredwg: - Update to snapshot 0.14.8413 fix dwgnextentity NULL pointer dereference CVE-2026-15184, boo1271170 Fix dwgbmp thumbnail...
CVE-2026-53518
Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint for the authorizationcode grant redeems a single-use authorization code through a non-atomic find-then-delete sequence, allowing two...
CVE-2026-53518 Better Auth OAuth Provider: Race Condition in Authorization Code Exchange Enables Multi-Use Code Redemption
Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint for the authorizationcode grant redeems a single-use authorization code through a non-atomic find-then-delete sequence, allowing two...
CVE-2026-20146
creationtimestamp| type| source ---|---|--- 2026-07-15 17:11:14+00:00| seen| https://infosec.exchange/users/AAKL/statuses/116925102408110334 2026-07-20 00:04:15+00:00| seen| https://bsky.app/profile/deafnews-auto.bsky.social/post/3mqzymsvplg2e...
CVE-2026-20153
creationtimestamp| type| source ---|---|--- 2026-07-15 17:11:14+00:00| seen| https://infosec.exchange/users/AAKL/statuses/116925102408110334 2026-07-16 00:09:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116926745966884527 2026-07-16 13:00:30+00:00| seen|...
CVE-2026-47158 Vaultwarden: CSRF in SSO Authorization Flow
Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO authorization flow did not bind the OAuth state parameter accepted by /connect/authorize to the initiating browser session, allowed attacker-controlled PKCE parameters, and left SsoAuth records intact...
EUVD-2026-44693
Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO authorization flow did not bind the OAuth state parameter accepted by /connect/authorize to the initiating browser session, allowed attacker-controlled PKCE parameters, and left SsoAuth records intact...
CVE-2026-59837
creationtimestamp| type| source ---|---|--- 2026-07-15 10:13:15+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116923458848771348 2026-07-15 14:20:29+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mqow55nlat2n...
CVE-2026-59839
creationtimestamp| type| source ---|---|--- 2026-07-15 07:22:41+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116922788149851186 2026-07-15 14:20:29+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mqow55nlat2n...
SUSE CVE-2026-57221
RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ does not perform authorization checks on passive queue.declare and exchange.declare AMQP 0-9-1 operations, allowing any authenticated user who can connect to a virtual host to enumerate queue and...
Oracle Linux 10 : openssh (ELSA-2026-19069)
The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-19069 advisory. - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode Resolves: RHEL-164739 - CVE-2026-35388: Add...
JLSEC-2026-713
Heap-based buffer overflow in the KCAPI ECC code path of wceccimportx963ex in wolfSSL wolfcrypt allows a remote attacker to write attacker-controlled data past the bounds of the pubkeyraw buffer via a crafted oversized EC public key point. The WOLFSSLKCAPIECC code path copies the input to...
JLSEC-2026-701
In wolfSSL 5.8.2 and earlier, a logic flaw existed in the TLS 1.2 server state machine implementation. The server could incorrectly accept the CertificateVerify message before the ClientKeyExchange message had been received. This issue affects wolfSSL before 5.8.4 wolfSSL 5.8.2 and earlier is...
CVE-2026-58594
creationtimestamp| type| source ---|---|--- 2026-07-14 19:01:08+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0231 2026-07-14 20:24:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqmzymy37d2x 2026-07-14 22:03:25+00:00| seen|...
CVE-2026-50380
creationtimestamp| type| source ---|---|--- 2026-07-14 19:01:04+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0231 2026-07-14 20:06:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqmyydrqg72z 2026-07-14 22:02:20+00:00| seen|...