55 matches found
CVE-2026-87865
When libcurl uses libssh2 with a hashed "knownhosts" file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the "CURLOPTSSHKEYFUNCTION" callback...
CURL-CVE-2026-87865 knownhost callback mismatches key as missing
When libcurl uses libssh2 with a hashed knownhosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPTSSHKEYFUNCTION callback...
CVE-2026-102275 PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion
PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.fromjwk in jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding ...
SUSE CVE-2026-89032
BerriAI LiteLLM before 1.101.0-rc.1 contains a tenant isolation bypass vulnerability in the semantic cache layer that allows authenticated users to read other tenants' cached responses by exploiting a metadata key mismatch between getsemanticcachetenantscope and getmetadatavariablename. Attackers...
CVE-2026-89032
BerriAI LiteLLM before 1.101.0-rc.1 contains a tenant isolation bypass vulnerability in the semantic cache layer that allows authenticated users to read other tenants' cached responses by exploiting a metadata key mismatch between getsemanticcachetenantscope and getmetadatavariablename. Attackers...
EUVD-2026-87147
BerriAI LiteLLM before 1.101.0-rc.1 contains a tenant isolation bypass vulnerability in the semantic cache layer that allows authenticated users to read other tenants' cached responses by exploiting a metadata key mismatch between getsemanticcachetenantscope and getmetadatavariablename. Attackers...
CVE-2026-89032 BerriAI LiteLLM < 1.101.0-rc.1 Tenant Isolation Bypass via Semantic Cache Layer
BerriAI LiteLLM before 1.101.0-rc.1 contains a tenant isolation bypass vulnerability in the semantic cache layer that allows authenticated users to read other tenants' cached responses by exploiting a metadata key mismatch between getsemanticcachetenantscope and getmetadatavariablename. Attackers...
CVE-2026-89032
BerriAI LiteLLM before 1.101.0-rc.1 contains a tenant isolation bypass vulnerability in the semantic cache layer that allows authenticated users to read other tenants' cached responses by exploiting a metadata key mismatch between getsemanticcachetenantscope and getmetadatavariablename. Attackers...
CVE-2026-89032
BerriAI LiteLLM versions prior to 1.101.0-rc.1 are vulnerable to a tenant isolation bypass within the semantic cache layer . The flaw is caused by a metadata key mismatch between the _get_semantic_cache_tenant_scope() and _get_metadata_variable_name() functions. An authenticated remote attacker w...
CVE-2026-89032 BerriAI LiteLLM < 1.101.0-rc.1 Tenant Isolation Bypass via Semantic Cache Layer
BerriAI LiteLLM before 1.101.0-rc.1 contains a tenant isolation bypass vulnerability in the semantic cache layer that allows authenticated users to read other tenants' cached responses by exploiting a metadata key mismatch between getsemanticcachetenantscope and getmetadatavariablename. Attackers...
CVE-2026-89032 BerriAI LiteLLM < 1.101.0-rc.1 Tenant Isolation Bypass via Semantic Cache Layer
BerriAI LiteLLM before 1.101.0-rc.1 contains a tenant isolation bypass vulnerability in the semantic cache layer that allows authenticated users to read other tenants' cached responses by exploiting a metadata key mismatch between getsemanticcachetenantscope and getmetadatavariablename. Attackers...
CVE-2026-89032: Incorrect Authorization
BerriAI LiteLLM before 1.101.0-rc.1 contains a tenant isolation bypass vulnerability in the semantic cache layer that allows authenticated users to read other tenants' cached responses by exploiting a metadata key mismatch between getsemanticcachetenantscope and getmetadatavariablename. Attackers...
CVE-2026-14916
A JWT signature verification vulnerability affects Kong components that perform JWT validation for MCP OAuth2 or DataKit integrations inside Kong API Gateway Enterprise. The affected code does not properly validate that the JWT signing algorithm is compatible with the type of key used for...
Astra Linux – Vulnerability in libssh
A flaw was discovered in the abstract layer of the libssh library responsible for message digest MD operations, which is implemented by different supported crypto backends. The return values from these operations were not properly checked, which could lead to low-memory situations, NULL...
EulerOS 2.0 SP12 : curl (EulerOS-SA-2026-3253)
According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw in curl's cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables a...
CVE-2026-67276
RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can...
CVE-2026-67276 SSH user impersonation possible in Mikrotik RouterOS
RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can...
VulnCheck KEV: CVE-2026-67276
RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can...
K000162881: libcurl vulnerability CVE-2026-9547
Security Advisory Description When a libcurl-based application performs transfers via SCP:// or SFTP:// and utilizes the CURLOPTSSHKEYFUNCTION callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific ke...
JLSEC-2026-1222 When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the ...
When a libcurl-based application performs transfers via SCP:// or SFTP:// and utilizes the CURLOPTSSHKEYFUNCTION callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for th...