CVE-2026-90453

A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without validating it against the application's own origin. This allows an authenticated attacker to craft a request that causes another user's browser to be...

CVE-2026-90452

Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify the identity provider's server certificate. An attacker positioned on the network path between the proxy and the identity provider could impersonate the...

Yordam-Kutuphane-Otomasyonunda-Coklu-HTML-Enjeksiyonu

Yordam-Kütüphane-Otomasyonunda-Çoklu-HTML-Enjeksiyonu CVE-2026-77818 · CVSS 3.1 6.1 Orta · Siber Güvenlik Başkanlığı · Yayımlanma 2026-09-04 · TR-26-1011 Durum: Zafiyetler v22.2 sürümünde giderilmiştir. Etkilenen kurulumların v22.2 veya üzerine yükseltilmesi gerekmektedir. Genel Bakış Yordam...

CVE-2026-90451

An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis component. A deployment that copies this example file into active configuration without running the setup routine that regenerates the value...

CVE-2026-90450

The application's role-authorization lookup defaults to granting access when a request handler's name is not present in its table of role requirements, rather than defaulting to deny. Any request handler that is not explicitly registered in this table is reachable by any authenticated user...

CVE-2026-90448

A deployment mode intended to expose only read access to stored data proxies a set of application programming interface routes without restricting which request methods are allowed. One such route accepts a request that creates or overwrites a stored record, including an attacker-chosen identifie...

CVE-2026-90447

A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than on any property the client cannot control. An authenticated user in possession of a shared service credential can set this...

CVE-2026-90446

An application programming interface endpoint accepts a user-supplied value and interpolates it directly into the path of a backend request to the underlying search and analytics data store, without restricting its contents. This allows an authenticated attacker to substitute an arbitrary backend...

CVE-2026-90445

An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory. This allows an authenticated attacker to craft an archive whose entries traverse outside the...

CVE-2026-90443

A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding, and does not require authentication to reach. This allows an unauthenticated network attacker to craft a link that, when visited by a user, executes arbitrary script in...

adversary_emulation_library

Adversary Emulation Library In collaboration with Center Participants, the MITRE Center for Threat-Informed Defense Center maintains a library of adversary emulation plans to allow organizations to evaluate their defensive capabilities against the real-world threats they face. Emulation plans are...

ROOT-OS-DEBIAN-12-CVE-2026-28902 CVE-2026-28902 in webkit2gtk - Patched by Root

Root has patched CVE-2026-28902 in the webkit2gtk package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-43715 CVE-2026-43715 in webkit2gtk - Patched by Root

Root has patched CVE-2026-43715 in the webkit2gtk package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-43660 CVE-2026-43660 in webkit2gtk - Patched by Root

Root has patched CVE-2026-43660 in the webkit2gtk package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-43725 CVE-2026-43725 in webkit2gtk - Patched by Root

Root has patched CVE-2026-43725 in the webkit2gtk package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-28847 CVE-2026-28847 in webkit2gtk - Patched by Root

Root has patched CVE-2026-28847 in the webkit2gtk package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-28942 CVE-2026-28942 in webkit2gtk - Patched by Root

Root has patched CVE-2026-28942 in the webkit2gtk package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-28907 CVE-2026-28907 in webkit2gtk - Patched by Root

Root has patched CVE-2026-28907 in the webkit2gtk package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-43705 CVE-2026-43705 in webkit2gtk - Patched by Root

Root has patched CVE-2026-43705 in the webkit2gtk package for Root:Debian:12. Multiple fixed versions available...

dpapi-ng

dpaping - Biblioteca de des-/cifrado DPAPI-NG para Python Biblioteca para el des-/cifrado de DPAPI NG, también conocido como CNG DPAPI, en Python. Está diseñada para replicar el comportamiento de NCryptUnprotectSecret y NCryptProtectSecret. Puede utilizarse en hosts que no sean Windows para...