228 matches found
openclarity
OpenClarity is an open source tool for agentless detection and management of Virtual Machine Software Bill Of Materials SBOM and security threats such as vulnerabilities, exploits, malware, rootkits, misconfigurations and leaked secrets. Join OpenClarity's Slack channel to hear about the latest...
CVE-2026-90933: Missing Authorization
laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allows any authenticated user to read, overwrite, and delete premium module license keys. Attackers with low-privileged accounts can access GET /api/admin/licenses/show, POST...
153M+ driver’s licenses for sale on new dark web platform
A new dark web platform called Nexus claimed to be selling 153 million driver’s license scans and millions of other identity and medical cards. The collection included more than 153 million driver’s licenses, 10 million ID cards, 3 million travel documents, and 579,000 medical cards, including...
FBI Probes Service Selling 153M+ Drivers Licenses
A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada. Based on interviews with individuals whose licenses are available for purchase on this service, it appears to be siphonin...
EUVD-2026-42986
Snipe-IT has missing object-level authorization in Kits API...
CVE-2026-33818 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-route53, k8ssandra-operator, skopeo, step-issuer, crossplane-provider-family-aws, go-discover, victoriametrics, redis-operator, gitlab-pages, prometheus, rancher-fleet, maru, whereabouts, cloud-provider-vsphere, istio, tigera-operator,...
GO-2026-6090 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-route53, k8ssandra-operator, skopeo, step-issuer, crossplane-provider-family-aws, go-discover, victoriametrics, redis-operator, gitlab-pages, prometheus, rancher-fleet, maru, whereabouts, cloud-provider-vsphere, istio, tigera-operator,...
GO-2026-5972 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-route53, k8ssandra-operator, skopeo, step-issuer, crossplane-provider-family-aws, go-discover, victoriametrics, redis-operator, gitlab-pages, prometheus, rancher-fleet, maru, whereabouts, cloud-provider-vsphere, istio, tigera-operator,...
CVE-2026-56862 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-route53, k8ssandra-operator, skopeo, step-issuer, crossplane-provider-family-aws, go-discover, victoriametrics, redis-operator, gitlab-pages, prometheus, rancher-fleet, maru, whereabouts, cloud-provider-vsphere, istio, tigera-operator,...
GO-2025-3368 vulnerabilities
Vulnerabilities for packages: scorecard, melange, timoni, grype, zot, src-fingerprint, trivy, task, wolfictl, snyk-cli, pulumi-language-java, osv-scanner, zarf, kaniko, pulumi-kubernetes-operator, argocd-image-updater, dagger, flux-kustomize-controller, tfsec, flux, pulumi, apko, kubevela,...
GO-2025-3367 vulnerabilities
Vulnerabilities for packages: scorecard, melange, timoni, grype, zot, src-fingerprint, trivy, task, wolfictl, snyk-cli, pulumi-language-java, osv-scanner, zarf, kaniko, pulumi-kubernetes-operator, argocd-image-updater, dagger, flux-kustomize-controller, tfsec, flux, pulumi, apko, kubevela,...
GO-2026-4340 vulnerabilities
Vulnerabilities for packages: chart-testing, terraform-mcp-server, wgcf, terraform, crossplane-provider-aws-cloudformation, crossplane-provider-family-aws, crossplane-provider-sql, conftest, wave, aws-eks-pod-identity-agent, vertical-pod-autoscaler, kube-bench, blobfuse2, calico,...
CVE-2026-12690 ProfileGrid < 5.9.9.7 - Subscriber+ Premium License Tampering via Missing Authorization
The ProfileGrid WordPress plugin before 5.9.9.7 does not perform a capability check on its license management actions, relying only on a nonce that is exposed to any logged-in user, allowing authenticated users with Subscriber-level access and above to overwrite the site's premium license setting...
Authorization Bypass Through User-Controlled Key
Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the POST /api/v1/kits/kitid/licenses endpoint. An attacker can gain unauthorized access to and manipulate license object...
CVE-2026-55479
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the legacy single-seat license checkin flow authorizes the action with the checkout permission instead of the checkin permission, allowing a user who can assign licenses but not unassign them to directly access the old checkin...
CVE-2026-55478 Snipe-IT: Missing object-level authorization in Kits API
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, POST /api/v1/kits/kitid/licenses checks whether the caller can edit kits but does not authorize access to the referenced license object, allowing a low-privilege user with predefined-kit permissions to bind a license they should n...
CVE-2026-55478 Snipe-IT: Missing object-level authorization in Kits API
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, POST /api/v1/kits/kitid/licenses checks whether the caller can edit kits but does not authorize access to the referenced license object, allowing a low-privilege user with predefined-kit permissions to bind a license they should n...
CVE-2026-55478 Snipe-IT: Missing object-level authorization in Kits API
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, POST /api/v1/kits/kitid/licenses checks whether the caller can edit kits but does not authorize access to the referenced license object, allowing a low-privilege user with predefined-kit permissions to bind a license they should n...
CVE-2026-55478
Snipe-IT (IT asset/license management) has a vulnerability in the Kits API. Before version 8.6.2, POST /api/v1/kits/{kit_id}/licenses validates the caller’s ability to edit kits but does not authorize access to the referenced license object. This allows a low-privilege user with predefined-kit pe...
CVE-2026-55478: Authorization Bypass Through User-Controlled Key
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, POST /api/v1/kits/kitid/licenses checks whether the caller can edit kits but does not authorize access to the referenced license object, allowing a low-privilege user with predefined-kit permissions to bind a license they should n...