CVE-2026-111999

Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/ns/eventbus/name/events or legacy...

CVE-2026-111999 Vanus 0.8.0 through 0.9.0 Missing Authentication via Gateway CloudEvents HTTP Receiver

Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/ns/eventbus/name/events or legacy...

CVE-2026-111999 Vanus 0.8.0 through 0.9.0 Missing Authentication via Gateway CloudEvents HTTP Receiver

Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/ns/eventbus/name/events or legacy...

EUVD-2026-103452

Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/ns/eventbus/name/events or legacy...

CVE-2026-111999

Versions 0.8.0 through 0.9.0 of Vanus are affected by a missing authentication vulnerability in the gateway CloudEvents HTTP receiver . This flaw allows unauthenticated remote attackers to bypass token authentication and authPublish checks by sending forged CloudEvents to the /namespaces/{ns}/eve...

Exploit for CVE-2026-80343

CVE-2026-80343 — camel-netty-http: security-constraint case-se...

Exploit for CVE-2026-103849

CVE-2026-103849 / BlockStrap validation lab !Static validat...

EUVD-2026-103386

A vulnerability has been found in David-Crty Databasement up to 1.8.1. Affected by this vulnerability is an unknown functionality of the file app/Http/Requests/Api/V1/SaveScheduledRestoreRequest.php of the component Scheduled Restore. Such manipulation of the argument schemaname leads to missing...

Debian dla-4842 : haproxy - security update

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dla-4842 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4842-1 [email protected] https://www.debian.org/lts/security/...

CVE-2026-105661: Uncaught Exception

Requesting /username/-/repositories for an individual user instead of an organization made the organization home handler dereference a nil organization and panic. The request needs no authentication and no special configuration. The server answered with an HTTP 500 error and logged a panic for ea...

CVE-2026-112006: Improper Certificate Validation

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTELEXPORTEROTLPCERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alte...

CVE-2026-111999: Missing Authentication for Critical Function

Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/ns/eventbus/name/events or legacy...

Apache Camel camel-netty-http 4.22.0 Security Constraint Bypass

Apache Camel camel-netty-http version 4.22.0 contains a security constraint bypass vulnerability. A proof of concept demonstrates that altering a request context-path case can bypass configured authentication and reach a protected route. https://packetstorm.news/download/236141...

PT-2026-116603

Name of the Vulnerable Software and Affected Versions Vanus versions 0.8.0 through 0.9.0 Description An authentication flaw exists in the gateway CloudEvents HTTP receiver, allowing unauthenticated remote attackers to publish events to any eventbus. Attackers can bypass token authentication and...

PT-2026-116610

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTEL EXPORTER OTLP CERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or...

PT-2026-117151

Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority SSH TRUSTED USER CA KEYS and accepts arbitrary principals SSH AUTHORIZED PRINCIPALS ALLOW=anything, a user could...

CVE-2026-111933

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare substitutes a placeholder hash derived from the string "hunter2" when a stored password hash is empty. Unauthenticated attackers can...

CVE-2026-111926

Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handler returns the full agent manifest, including template-provided environment variable values. A lower-privileged Unix user or process in the same workspace can query this...

CVE-2026-111887

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an account enumeration vulnerability that allows unauthenticated attackers to confirm registered display names and emails via a distinct HTTP 409 response. Attackers can submit guest comments to the comment create endpoint with...

CVE-2026-111933 Coder before 2.34.2 User Enumeration via Login Placeholder Hash

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare substitutes a placeholder hash derived from the string "hunter2" when a stored password hash is empty. Unauthenticated attackers can...