CVE-2026-71209

Audiobookshelf CVE-2026-71209 describes an authentication-exemption bypass in server/routers/Auth.js. The regex checks unauthenticated GET routes against req.path, but because req.path can contain URL-encoded %2F sequences, an encoded directory traversal like ..%2f..%2f..%2ftmp%2fpwned escapes th...

CVE-2026-71209 audiobookshelf - %2F Encoding Discrepancy Bypasses Cover/Image Auth Exemption Regex, Enabling Unauthenticated Path Traversal

audiobookshelf's authentication-exemption check server/routers/Auth.js matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /items/:id/cover or /authors/:id/image shape, where req.path retains %2F sequences URL-encoded. CacheManager.handleCoverCache then joi...

EUVD-2026-53206

audiobookshelf's authentication-exemption check server/routers/Auth.js matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /items/:id/cover or /authors/:id/image shape, where req.path retains %2F sequences URL-encoded. Express's router decodes the :id route...

SUSE CVE-2026-64448

In the Linux kernel, the following vulnerability has been resolved: smb: client: restrict implied bcc0 exemption to responses without data area smb2checkmessage has a long-standing quirk that accepts a response whose calculated length is one byte larger than the bytes actually received "server ca...

CVE-2026-64448

In the Linux kernel, the following vulnerability has been resolved: smb: client: restrict implied bcc0 exemption to responses without data area smb2checkmessage has a long-standing quirk that accepts a response whose calculated length is one byte larger than the bytes actually received "server ca...

UBUNTU-CVE-2026-64448

In the Linux kernel, the following vulnerability has been resolved: smb: client: restrict implied bcc0 exemption to responses without data area smb2checkmessage has a long-standing quirk that accepts a response whose calculated length is one byte larger than the bytes actually received "server ca...

CVE-2026-64448 smb: client: restrict implied bcc[0] exemption to responses without data area

In the Linux kernel, the following vulnerability has been resolved: smb: client: restrict implied bcc0 exemption to responses without data area smb2checkmessage has a long-standing quirk that accepts a response whose calculated length is one byte larger than the bytes actually received "server ca...

CVE-2026-64448

In the Linux kernel, the following vulnerability has been resolved: smb: client: restrict implied bcc0 exemption to responses without data area smb2checkmessage has a long-standing quirk that accepts a response whose calculated length is one byte larger than the bytes actually received "server ca...

CVE-2026-64448 smb: client: restrict implied bcc[0] exemption to responses without data area

In the Linux kernel, the following vulnerability has been resolved: smb: client: restrict implied bcc0 exemption to responses without data area smb2checkmessage has a long-standing quirk that accepts a response whose calculated length is one byte larger than the bytes actually received "server ca...

CVE-2026-64448

Summary (CVE-2026-64448): The Linux kernel fix addresses a SMB2 negotiation bug in CIFS/NTLM handling. A long-standing quirk in smb2_check_message() unconditionally granted a +1 length exemption for responses, even when a data area was present. This could cause the decoder to read past the receiv...

EUVD-2026-48792

In the Linux kernel, the following vulnerability has been resolved: smb: client: restrict implied bcc0 exemption to responses without data area smb2checkmessage has a long-standing quirk that accepts a response whose calculated length is one byte larger than the bytes actually received "server ca...

PYSEC-2026-2418 CKAN has CSRF exemption primed by anonymous requests

Views can be marked as exempt from CSRF protection Access to the views via tokens or unauthenticated requests marked the endpoint as not requiring CSRF protection. The marking was a member variable in flask-wtf.csrf.CSRFProtect, which was stored as a module level variable in the flaskapp...

CVE-2026-49779

Path Traversal: '.../...//' vulnerability in Addify Tax Exempt for WooCommerce allows Path Traversal. This issue affects Tax Exempt for WooCommerce: from n/a before 1.9.5...

CVE-2026-49779 WordPress Tax Exempt for WooCommerce plugin < 1.9.5 - Path Traversal vulnerability

Path Traversal: '.../...//' vulnerability in Addify Tax Exempt for WooCommerce allows Path Traversal. This issue affects Tax Exempt for WooCommerce: from n/a before 1.9.5...

PT-2026-54985

Name of the Vulnerable Software and Affected Versions Tax Exempt for WooCommerce versions prior to 1.9.5 Description An issue in the Addify Tax Exempt for WooCommerce plugin allows for path traversal, a condition where an attacker can access files and directories that are stored outside the web...

CVE-2026-55964

Chain intermediate CA:TRUE without keyCertSign accepted as a signing CA. Intermediate CA certificates are required to have the keyCertSign key usage when a Key Usage extension is present, but chain-supplied temporary CAs WOLFSSLTEMPCA added while building a certificate path were previously exempt...

CVE-2026-55964 Chain intermediate CA:TRUE without keyCertSign accepted as a signing CA (temporary CA exemption)

Chain intermediate CA:TRUE without keyCertSign accepted as a signing CA. Intermediate CA certificates are required to have the keyCertSign key usage when a Key Usage extension is present, but chain-supplied temporary CAs WOLFSSLTEMPCA added while building a certificate path were previously exempt...

CVE-2026-47264 Discourse: Don't leak restricted tag group names via tag info

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, DetailedTagSerializertaggroupnames returned every tag group a tag belonged to without filtering against the requesting...

PT-2026-48476

Name of the Vulnerable Software and Affected Versions @hulumi/policies versions prior to 1.4.0 Description A bypass exists in the H5 defense-in-depth check of the Hulumi hardening pack. The H5 check is designed to verify that raw aws:s3:Bucket resources acting as children of a SecureBucket...

GHSA-C635-393C-HCX2 Prefect has an Authentication Middleware Bypass when URL paths are appended with 'health' or 'ready'

In version 3.6.19 of prefecthq/prefect, an authentication bypass vulnerability exists due to the improper handling of URL path exemptions for health check probes. Specifically, the authentication middleware exempts any URL path ending with 'health' or 'ready' from authentication checks. This allo...