14846 matches found
CVE-2026-90767 Froxlor before 2.3.12 SSH Key Injection via authorized_keys
Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add endpoint, allowing customers to inject arbitrary lines into authorizedkeys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that...
CVE-2026-90767 Froxlor before 2.3.12 SSH Key Injection via authorized_keys
Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add endpoint, allowing customers to inject arbitrary lines into authorizedkeys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that...
PT-2026-90834
Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add endpoint, allowing customers to inject arbitrary lines into authorized keys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that...
CLSA-2026-1789220666 TuxCare security update for 40 packages (2 CVEs)
TuxCare rebuilt 40 packages to address 2 CVEs. Fixed in 10.1.42-tuxcare.10...
CVE-2026-84363 vulnerabilities
Vulnerabilities for packages: librechat, kibana, wazuh-dashboard-fips, wazuh-dashboard...
CVE-2026-80936
A flaw was found in the Linux kernel's mt7925 Wi-Fi driver. During multi-link power-save setup, the mlopmwork is queued with a delay but not properly cancelled when the device is stopped. This can lead to the work item attempting to access a deallocated workqueue, resulting in a kernel warning an...
CVE-2026-80936
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: cancel mlopmwork on stop mt7925 queues mlopmwork with a 5 second delay during multi-link power-save setup and never cancels it on the stop path. If the device is torn down inside that window, the work outlives...
CVE-2026-80936
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: cancel mlopmwork on stop mt7925 queues mlopmwork with a 5 second delay during multi-link power-save setup and never cancels it on the stop path. If the device is torn down inside that window, the work outlives...
CVE-2026-84199
A flaw was found in Kyverno. A Server-Side Request Forgery SSRF vulnerability exists in the APICall feature due to improper validation of the URL field in a Policy's ServiceCall configuration. A user with namespace-level Policy creation permissions can exploit this to direct Kyverno to make HTTP...
Claude Used to Automate Exploitation and Data Theft Across Multiple Victims
Anthropic has warned that cybercriminals and state-sponsored hackers alike are using its Claude models for cyber attacks, weapons design, propaganda, and mass surveillance between December 2025 and August 2026. The threat actors, which the artificial intelligence AI company has branded Generative...
[SECURITY] Fedora 44 Update: curl-8.18.0-10.fc44
curl is a command line tool for transferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMA P, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...
CVE-2026-81540
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to overwrite ruleset files belonging to other tenants due to a path traversal vulnerability...
Security Bulletin: IBM MQ Appliance is affected by a heap buffer underflow vulnerability (CVE-2026-10858)
Summary IBM MQ Appliance has addressed a heap buffer underflow vulnerability that could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code when processing multi-segment messages. Vulnerability Details CVEID:CVE-2026-10858 DESCRIPTION: IBM MQ could...
CVE-2026-88898
AppFlowy-Cloud versions 0.7.2 through 0.9.64 contain a missing authorization check in the bulk publish endpoint , which fails to verify that the caller is authorized against the target workspace. An authenticated user can exploit this to publish content into other tenants' namespaces, writing vie...
CVE-2026-85597
A flaw was found in Traefik. This vulnerability allows unauthenticated attackers to bypass client-certificate authentication. By creating conflicting Transport Layer Security TLS options on multi-host routers, attackers can exploit shared TLS resolution across multiple hostnames in a single route...
CVE-2026-88894 Snipe-IT before 8.7.2 Authorization Bypass via Predefined Kit Checkout
Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support FMCS tenant isolation on the checkout target. Unlike the single, bulk, API, accessory, license and consumable checkout paths, App\Services\PredefinedKitCheckoutService never calls $item-canCheckoutTo$target; it...
CVE-2026-8323
creationtimestamp| type| source ---|---|--- 2026-09-10 10:05:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/cgolcynnqt54y 2026-09-10 10:08:04+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mv5smfebby2n 2026-09-10 10:20:06+00:00| seen|...
PYSEC-2026-3926 Apache Thrift Python, Go, PHP and Java bindings have an Infinite Loop
Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...
PYSEC-2026-3813 ChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection
A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to...