45729 matches found
com.vaadin:vaadin-platform-test (10.0.2), org.rapidpm.vaadin:rapidpm-vaadin-cdi-m-integration-tests (00.07.04-rpm) +4 more potentially affected by CVE-2026-2742 via com.vaadin:vaadin (10.0.2)
com.vaadin:vaadin MAVEN version 10.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:vaadin and may be impacted: - com.vaadin:vaadin-platform-test 10.0.2 - org.rapidpm.vaadin:rapidpm-vaadin-cdi-m-integration-tests 00.07.04-rpm -...
EUVD-2026-10694
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network...
EUVD-2026-10696
Incorrect default permissions in .NET allows an authorized attacker to elevate privileges locally...
com.vaadin:vaadin-platform-test (10.0.10), org.rapidpm:rapidpm-vaadin-testbench-ng-m-framework-v10 (>=01.00.02-rpm, <=01.00.03-rpm) +1 more potentially affected by CVE-2026-2742 via com.vaadin:vaadin (10.0.10)
com.vaadin:vaadin MAVEN version 10.0.10 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:vaadin and may be impacted: - com.vaadin:vaadin-platform-test 10.0.10 - org.rapidpm:rapidpm-vaadin-testbench-ng-m-framework-v10 =01.00.02-rpm,...
com.vaadin:vaadin-platform-test (10.0.9), org.rapidpm:rapidpm-vaadin-testbench-ng-m-framework-v10 (>=01.00.00-rpm, <=01.00.01-rpm) +1 more potentially affected by CVE-2026-2742 via com.vaadin:vaadin (10.0.9)
com.vaadin:vaadin MAVEN version 10.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:vaadin and may be impacted: - com.vaadin:vaadin-platform-test 10.0.9 - org.rapidpm:rapidpm-vaadin-testbench-ng-m-framework-v10 =01.00.00-rpm, =01.00.00-rp...
CVE-2026-2742
An authentication bypass vulnerability exists in Vaadin 14.0.0 through 14.14.0, 23.0.0 through 23.6.6, 24.0.0 through 24.9.7 and 25.0.0 through 25.0.1, applications using Spring Security due to inconsistent path pattern matching of reserved framework paths. Accessing the /VAADIN endpoint without ...
CVE-2026-30964 Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation
web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. Prior to 5.2.4, when allowedorigins is configured, CheckAllowedOrigins reduces URL-like values to their host component and...
CVE-2026-30964 Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation
web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. Prior to 5.2.4, when allowedorigins is configured, CheckAllowedOrigins reduces URL-like values to their host component and...
CVE-2026-30964 Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation
web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. Prior to 5.2.4, when allowedorigins is configured, CheckAllowedOrigins reduces URL-like values to their host component and...
CVE-2026-30964
The connected GHSA entry describes a concrete vulnerability in Webauthn Framework: when allowed_origins is configured, CheckAllowedOrigins reduces URL-like origins to their host, causing mismatched origins (scheme/port) to be treated as the same host. This bypasses the strict origin validation re...
CVE-2026-26130
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network...
CVE-2026-26127
Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network...
CVE-2026-26131 .NET Elevation of Privilege Vulnerability
...
CVE-2026-26131
Incorrect default permissions in .NET allows an authorized attacker to elevate privileges locally...
2026-03 .NET 8.0.25 Security Update for x86 Client (KB5081277)
2026-03 .NET 8.0.25 Security Update for x86 Client KB5081277...
2026-03 .NET 8.0.25 Security Update for x64 Client (KB5081277)
2026-03 .NET 8.0.25 Security Update for x64 Client KB5081277...
CVE-2026-30942 Flare has a Path Traversal in /api/avatars/[filename]
Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Prior to 1.7.3, an authenticated path traversal vulnerability in /api/avatars/filename allows any logged-in user to read arbitrary files from within the application container. The filename URL...
Security update for python-aiohttp
This update for python-aiohttp fixes the following issues: CVE-2025-69228: Fixed denial of service through large payloads bsc1256022. CVE-2025-69226: Fixed brute-force leak of internal static file path components bsc1256020. CVE-2025-69224: Fixed unicode processing of header values could cause...
From Shadow Models to Audit-Ready AI Security: A Practical Path with Qualys TotalAI
Key Takeaways AI security demands a paradigm shift, treating models, endpoints, and integrations as dynamic attack surfaces requiring continuous governance. Inventory-driven visibility is foundational to managing AI sprawl, uncovering hidden assets, and aligning security with innovation velocity...
