Lucene search
+L

44172 matches found

Github Security Blog
Github Security Blog
added 2026/06/16 7:9 p.m.18 views

Deno: Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks

Summary Deno's network permission model is designed so that --deny-net rules apply to the resolved IP address of a destination, not just the literal string supplied by the caller. That means --deny-net=127.0.0.1 or --deny-net=127.0.0.0/8 is expected to block any attempt to reach loopback,...

6.5CVSS5.5AI score0.00144EPSS
SaveExploits1References3Affected Software1
Snyk
Snyk
added 2026/06/16 7:2 p.m.8 views

Authentication Bypass Using an Alternate Path or Channel

Overview Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel in the SNICheck process. An attacker can gain unauthorized access to protected backends by completing a TLS handshake using a permissive SNI and then sending an HTTP Host header...

10CVSS6AI score0.0028EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/06/16 7:2 p.m.6 views

Authentication Bypass Using an Alternate Path or Channel

Overview github.com/traefik/traefik/v2/pkg/server is a server package for traefik, a cloud native edge router. Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel in the SNICheck process. An attacker can gain unauthorized access to protecte...

10CVSS6AI score0.0028EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/06/16 7:2 p.m.8 views

Authentication Bypass Using an Alternate Path or Channel

Overview Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel in the SNICheck process. An attacker can gain unauthorized access to protected backends by completing a TLS handshake using a permissive SNI and then sending an HTTP Host header...

10CVSS6AI score0.0028EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/06/16 7:2 p.m.10 views

Authentication Bypass Using an Alternate Path or Channel

Overview Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel in the SNICheck process. An attacker can gain unauthorized access to protected backends by completing a TLS handshake using a permissive SNI and then sending an HTTP Host header...

10CVSS6AI score0.0028EPSS
SaveExploits1References2
Github Security Blog
Github Security Blog
added 2026/06/16 7:2 p.m.83 views

Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass

Summary There is a high severity vulnerability in Traefik's domain-fronting protection SNICheck that allows an unauthenticated client to bypass mutual TLS enforced through wildcard router TLSOptions. When a router uses a wildcard host rule such as Host.example.com with stricter TLS options for...

10CVSS5.1AI score0.0028EPSS
SaveExploits1References3Affected Software1
OSV
OSV
added 2026/06/16 6:53 p.m.9 views

MAL-2026-5921 Malicious code in proto-bin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1994859460fe293cad87eadf5c704e5c717c71deaaf54842f5e29fce765f99d5 Package is advertised as a prototype utilities library pack/unpack/checksum but its exported pack function calls an internal fetch that downloads a...

5.9AI score
SaveExploits0References4
Cvelist
Cvelist
added 2026/06/16 6:51 p.m.33 views

CVE-2026-0153

In Write of msgtohostbuffer.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

0.00068EPSS
SaveExploits0References1
Snyk
Snyk
added 2026/06/16 5:36 p.m.9 views

HTTP Request Smuggling

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to HTTP Request Smuggling via improper validation of the Host header in the request scope. An attacker can gain unauthorized access to API endpoints by...

9.1CVSS5.9AI score0.01152EPSS
SaveExploits0References2
OSV
OSV
added 2026/06/16 5:36 p.m.13 views

GHSA-94F4-HR76-P5J6 vLLM: OpenAI auth bypass

Summary A vulnerability in ASGI web servers and starlette's trust on those web servers enables an authentication bypass of the OpenAI API AuthenticationMiddleware, which was discovered during @x41sec's source code audit. It allows to use the API without providing the configured VLLMAPIKEY or...

9.1CVSS5.6AI score0.01152EPSS
SaveExploits0References17
Github Security Blog
Github Security Blog
added 2026/06/16 5:36 p.m.90 views

vLLM: OpenAI auth bypass

Summary A vulnerability in ASGI web servers and starlette's trust on those web servers enables an authentication bypass of the OpenAI API AuthenticationMiddleware, which was discovered during @x41sec's source code audit. It allows to use the API without providing the configured VLLMAPIKEY or...

9.1CVSS5.5AI score0.01152EPSS
SaveExploits0References17Affected Software1
NVD
NVD
added 2026/06/16 5:16 p.m.17 views

CVE-2026-44932

Passing of unsanitized strings from DHCP replies into the wicked dhcp client before wicked 0.6.79 could be used by attackers operating a malicious DHCP server to execute code on the local machine...

8.8CVSS0.00355EPSS
SaveExploits0References6
NVD
NVD
added 2026/06/16 5:16 p.m.14 views

CVE-2024-38487

api-gateway container running with root privilege would allow an attacker to escape the container and access host system to perform unintended actions...

7CVSS0.00081EPSS
SaveExploits0References1
IBM Security Bulletins
IBM Security Bulletins
added 2026/06/16 4:51 p.m.15 views

Security Bulletin: Multiple vulnerabilities in IBM Aspera Faspex

Summary Multiple vulnerabilities were addressed in IBM Aspera Faspex 5.0.15.4 Vulnerability Details CVEID:CVE-2026-6322 DESCRIPTION: fast-uri normalize decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host th...

7.5CVSS5.3AI score0.00781EPSS
SaveExploits0Affected Software6
CVE
CVE
added 2026/06/16 4:29 p.m.25 views

CVE-2024-38487

CVE-2024-38487 describes a vulnerability where an api-gateway container running with root privileges could escape the container and access the host system. Affected configuration: containerized api-gateway with root-level execution; root privileges combined with local attack vector enable host ac...

7CVSS5.3AI score0.00081EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/06/16 4:29 p.m.28 views

CVE-2024-38487

api-gateway container running with root privilege would allow an attacker to escape the container and access host system to perform unintended actions...

7CVSS0.00081EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/06/16 4:29 p.m.11 views

EUVD-2024-55624

api-gateway container running with root privilege would allow an attacker to escape the container and access host system to perform unintended actions...

7CVSS5.2AI score0.00081EPSS
SaveExploits0References1
OSV
OSV
added 2026/06/16 4:22 p.m.9 views

MAL-2026-5903 Malicious code in chai-guid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69e9bcacf8dca52aafe4d93019b888c6d32e344b500a21368f036bf586eee161 chai-guid impersonates the pino logger and the chai-guid chai plugin README copies pino badges and pinojs CI links; index.js exports middleware as...

5.4AI score
SaveExploits0References1
Cvelist
Cvelist
added 2026/06/16 3:26 p.m.33 views

CVE-2026-44932 indirect remote shell command injection via unsanitized DHCP options in wicked

Passing of unsanitized strings from DHCP replies into the wicked dhcp client before wicked 0.6.79 could be used by attackers operating a malicious DHCP server to execute code on the local machine...

8.8CVSS0.00355EPSS
SaveExploits0References6
CVE
CVE
added 2026/06/16 3:26 p.m.73 views

CVE-2026-44932

Wicked (openSUSE/SUSE Linux) is affected by CVE-2026-44932 through an indirect remote shell command injection via unsanitized DHCP options. The root cause is unsanitized DHCP strings being handled by the wicked DHCP client, with leaseinfo dump output and certain option processing allowing code ex...

8.8CVSS5.5AI score0.00355EPSS
SaveExploits0References6
Rows per page
Query Builder