13415 matches found
tomcat: Apache Tomcat: Improper Authorization Allows Security Constraint Bypass
A flaw was found in Apache Tomcat where access control rules for the default servlet are improperly handled. An attacker can exploit this issue to bypass specific HTTP method restrictions, potentially gaining unauthorized access to protected application resources...
tomcat-coyote: tomcat: Improper Authorization allows security bypass
In Apache Tomcat, when multiple security constraints defined an HTTP method constraint for the same extension pattern, only the first method constraint was applied. A remote attacker could exploit this to bypass intended security restrictions for information or actions within the application...
tomcat-coyote: tomcat: Improper Authorization allows security bypass
In Apache Tomcat, when multiple security constraints defined an HTTP method constraint for the same extension pattern, only the first method constraint was applied. A remote attacker could exploit this to bypass intended security restrictions for information or actions within the application...
tomcat: Apache Tomcat: Improper Authorization Allows Security Constraint Bypass
A flaw was found in Apache Tomcat where access control rules for the default servlet are improperly handled. An attacker can exploit this issue to bypass specific HTTP method restrictions, potentially gaining unauthorized access to protected application resources...
MGASA-2026-0413 Updated python-starlette package fixes security vulnerabilities
Arbitrary HTTP method dispatched to HTTPEndpoint attributes via getattr. CVE-2026-48817 Unvalidated request path concatenated into authority poisons request.url.hostname. CVE-2026-54282...
CVE-2026-51990
An issue in Sogou Sogou Input Method 16.3.0.3498 fixed in 16.3.0.3498 allows a remote attacker to execute arbitrary code via the bizhelper.exe component...
CVE-2026-92129
Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not check calls from sandboxed scripts to methods added dynamically to a class at runtime, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute...
CVE-2026-61590 djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's observability endpoints expose live view/session state and a remote method-invocation surface evalhandler. The localhost restriction was an opt-in...
Exposure of Resource to Wrong Sphere
Overview djust is a Phoenix LiveView-style reactive components for Django with Rust-powered performance. Real-time UI updates over WebSocket, no JavaScript build step required. Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere through the evalhandler process...
CVE-2026-73461
On affected EOS platforms with AAA-based gRPC authorization enabled for OpenConfig, gRPC requests of an authenticated user to OpenConfig may use the wrong privilege level, resulting in an authorization using the wrong AAA method list. This does not impact non-gRPC OpenConfig requests such as...
CVE-2026-73461
CVE-2026-73461 is an incorrect privilege assignment (CWE-266) in Arista EOS affecting platforms with AAA-based gRPC authorization enabled for OpenConfig. An authenticated user's gRPC request may be processed at the wrong privilege level , causing authorization to use an incorrect AAA method list ...
CVE-2026-73461 Security Advisory 0163
On affected EOS platforms with AAA-based gRPC authorization enabled for OpenConfig, gRPC requests of an authenticated user to OpenConfig may use the wrong privilege level, resulting in an authorization using the wrong AAA method list. This does not impact non-gRPC OpenConfig requests such as...
CVE-2026-73461 Security Advisory 0163
On affected EOS platforms with AAA-based gRPC authorization enabled for OpenConfig, gRPC requests of an authenticated user to OpenConfig may use the wrong privilege level, resulting in an authorization using the wrong AAA method list. This does not impact non-gRPC OpenConfig requests such as...
EUVD-2026-80251
On affected EOS platforms with AAA-based gRPC authorization enabled for OpenConfig, gRPC requests of an authenticated user to OpenConfig may use the wrong privilege level, resulting in an authorization using the wrong AAA method list. This does not impact non-gRPC OpenConfig requests such as...
EUVD-2026-80932
An issue in Sogou Sogou Input Method 16.3.0.3498 fixed in 16.3.0.3498 allows a remote attacker to execute arbitrary code via the bizhelper.exe component...
CVE-2026-92122: Protection Mechanism Failure
Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not check the method called through the proxy created when a sandboxed script coerces a value to an interface, if the value inherits a method of the same name as an interface method, allowing attackers with permission to define an...
CVE-2026-51990
The Sogou Input Method for Windows (versions prior to 16.3.0.3498 ) is vulnerable to a remote code execution (RCE) attack chain triggered by a specially crafted link. The attack begins when a user clicks a sgbiz: URI, causing the biz_helper.exe component to pass unvalidated command-line arguments...
SUSE SLES15: helm / helm-bash-completion / helm-fish-completion / etc (SUSE-SU-2026:4175-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4175-1 advisory. - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through...
CVE-2026-61590: Missing Authentication for Critical Function
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's observability endpoints expose live view/session state and a remote method-invocation surface evalhandler. The localhost restriction was an opt-in...