CVE-2026-54180: Authorization Bypass Through User-Controlled Key

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, the Update, Delete, and Reorder operations resolve records from the unscoped model query inste...

CVE-2026-90623: Improper Certificate Validation

A weakness has been identified in andreashappe cochise up to 0.4.1. Affected is the function asyncssh.connect of the file src/cochise/sshconnection.py of the component SSH Host Key Handler. Executing a manipulation can lead to improper certificate validation. The attack may be launched remotely...

RHEL 9 : podman (RHSA-2026:67450)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67450 advisory. The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use...

PT-2026-91041

A weakness has been identified in andreashappe cochise up to 0.4.1. Affected is the function asyncssh.connect of the file src/cochise/ssh connection.py of the component SSH Host Key Handler. Executing a manipulation can lead to improper certificate validation. The attack may be launched remotely...

PT-2026-91289

Name of the Vulnerable Software and Affected Versions Casdoor versions prior to 4.4.1 Description Casdoor fails to properly mask the instance-wide built-in certificate private key. This allows organization administrators to retrieve the private key via the '/api/get-certs' and '/api/get-cert'...

CVE-2024-23176

An issue was discovered in the MassMessage extension in MediaWiki before 1.40.2. For a Special:MassMessage?uselang=x-xss URL, the i18n key massmessage-form-page-help allows XSS...

PT-2026-91226

Description Dependency artifacts uploaded with storm jar --artifacts were stored under a blob key derived only from the Maven coordinate, for example dep---.jar. The key was therefore identical for every user of the cluster and predictable in advance. When the blob already existed, the uploader...

Azure Cosmos DB Authentication Bypass

The vulnerability of the Azure Cosmos DB database management system is related to the ability to bypass authentication using a user-controlled key. Exploiting this vulnerability allows an attacker to perform brute-force attacks remotely...

SUSE SLED15: libzypp / libzypp-devel / zypper / zypper-log / etc (SUSE-SU-2026:4096-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4096-1 advisory. Security issue fixed: - invalidating legacy libzypp unsigned-repository cache state LIBZYPP-LEGACY-CACHE-01 bsc1274625....

CVE-2026-90562

LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint. Remote attackers knowing the administrator email can exhaust the keyspace through concurrent requests to reset the admin password and...

CVE-2026-90767

Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add endpoint, allowing customers to inject arbitrary lines into authorizedkeys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that...

CVE-2026-90510

A security vulnerability has been detected in dromara orion-visor up to 2.5.7. This affects the function HostKeyServiceImpl.encryptKey of the file...

CVE-2026-90771

joi (the Hapi.js validation library) before versions 17.13.8 and 18.2.9 is affected by a prototype pollution vulnerability in the messages compilation function . The root cause is that the function accepts __proto__ as a valid error code, allowing an attacker to supply __proto__ keys in custom er...

CVE-2026-90767

Froxlor versions before 2.3.12 contain an SSH key injection vulnerability in the SshKeys::add() API endpoint. The root cause is improper validation of multi-line SSH public keys , allowing customers to inject arbitrary lines into authorized_keys files. An attacker can exploit this to inject malic...

CVE-2026-90767 Froxlor before 2.3.12 SSH Key Injection via authorized_keys

Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add endpoint, allowing customers to inject arbitrary lines into authorizedkeys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that...

CVE-2026-90767 Froxlor before 2.3.12 SSH Key Injection via authorized_keys

Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add endpoint, allowing customers to inject arbitrary lines into authorizedkeys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that...

EUVD-2026-76988

Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add endpoint, allowing customers to inject arbitrary lines into authorizedkeys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that...

CVE-2026-90767 Froxlor before 2.3.12 SSH Key Injection via authorized_keys

Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add endpoint, allowing customers to inject arbitrary lines into authorizedkeys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that...

CVE-2026-90562 LangBot before 4.10.11 Authentication Bypass via Weak Recovery Key

LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint. Remote attackers knowing the administrator email can exhaust the keyspace through concurrent requests to reset the admin password and...

CVE-2026-90562 LangBot before 4.10.11 Authentication Bypass via Weak Recovery Key

LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint. Remote attackers knowing the administrator email can exhaust the keyspace through concurrent requests to reset the admin password and...