PT-2026-85222

Worklenz before 3.0.0 fails to verify task ownership by organization when resolving task-scoped API endpoints, allowing authenticated users to access another tenant's task data. Attackers can query task endpoints with arbitrary task UUIDs to retrieve work logs, comments, attachments, and project...

Casdoor authentication server is vulnerable to authorization bypass

Overview Casdoor is an open-source Access Management IAM platform used to manage web applications. An authorization bypass vulnerability affects Casdoor versions up to v4.2.0. The vulnerability allows a non-global organization administrator to perform unauthorized administrative actions against...

OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs

Summary The OpenChoreo control-plane cluster-gateway served its caller-facing management APIs on the same network listener that accepts data-plane agent connections. In the multi-cluster topology that listener is published outside the cluster, and the management APIs did not authenticate the...

EUVD-2026-58518

OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs...

CVE-2026-67313 vulnerabilities

Vulnerabilities for packages: semaphore, opensearch-dashboards, librechat, wazuh-dashboard, langfuse, lerna, redisinsight, jitsucom-jitsu, arangodb, kubeflow-centraldashboard, gitlab-rails-ce-fips, prism, kibana, opensearch-dashboards-fips, langfuse-fips, wazuh-dashboard-fips, gitlab-rails-ce,...

CVE-2026-67315 vulnerabilities

Vulnerabilities for packages: semaphore, opensearch-dashboards, librechat, wazuh-dashboard, langfuse, lerna, redisinsight, jitsucom-jitsu, kubeflow-centraldashboard, gitlab-rails-ce-fips, prism, kibana, opensearch-dashboards-fips, langfuse-fips, wazuh-dashboard-fips, gitlab-rails-ce,...

CVE-2026-67320 vulnerabilities

Vulnerabilities for packages: semaphore, opensearch-dashboards, librechat, wazuh-dashboard, langfuse, lerna, redisinsight, jitsucom-jitsu, kubeflow-centraldashboard, gitlab-rails-ce-fips, prism, kibana, opensearch-dashboards-fips, langfuse-fips, wazuh-dashboard-fips, gitlab-rails-ce,...

GHSA-FQ2J-3J99-RX65 vulnerabilities

Vulnerabilities for packages: semaphore, opensearch-dashboards, librechat, wazuh-dashboard, langfuse, lerna, redisinsight, jitsucom-jitsu, arangodb, kubeflow-centraldashboard, gitlab-rails-ce-fips, prism, kibana, opensearch-dashboards-fips, langfuse-fips, wazuh-dashboard-fips, gitlab-rails-ce,...

CVE-2026-67319 vulnerabilities

Vulnerabilities for packages: semaphore, opensearch-dashboards, librechat, wazuh-dashboard, langfuse, lerna, redisinsight, jitsucom-jitsu, arangodb, kubeflow-centraldashboard, gitlab-rails-ce-fips, prism, kibana, opensearch-dashboards-fips, langfuse-fips, wazuh-dashboard-fips, gitlab-rails-ce,...

CVE-2026-18401 vulnerabilities

Vulnerabilities for packages: knative-kafka-broker, ruby3.4-jrjackson, knative-kafka-broker-fips, ruby4.0-jrjackson, sonarqube, pinot-fips, py3-vllm-cuda-12.4, akhq, flyway, hono, apache-hop, kafka-bridge, nacos-docker, management-api-for-apache-cassandra-5.0, spdx-tools-java, spark-fips, s3proxy...

GHSA-6QM2-MCQ7-53QP vulnerabilities

Vulnerabilities for packages: knative-kafka-broker, ruby3.4-jrjackson, knative-kafka-broker-fips, ruby4.0-jrjackson, sonarqube, pinot-fips, py3-vllm-cuda-12.4, akhq, flyway, hono, apache-hop, kafka-bridge, nacos-docker, management-api-for-apache-cassandra-5.0, spdx-tools-java, spark-fips, s3proxy...

CVE-2026-67317 vulnerabilities

Vulnerabilities for packages: prism, kubeflow-centraldashboard, lerna, jitsucom-jitsu, langfuse, opensearch-dashboards, nextcloud-server...

CVE-2026-78587

Incorrect Authorization CWE-863 in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse CAPEC-122. Fleet Server does not correctly verify session ownership during multi-part data upload operations, allowing any authenticated agent to interfere with the activ...

CVE-2026-78587

Fleet Server (Elastic) contains an Incorrect Authorization (CWE-863) flaw where session ownership is not correctly verified during multi-part data upload operations. This allows any authenticated agent to interfere with active upload sessions belonging to other enrolled agents, resulting in a den...

CURL-CVE-2026-80229 OpenSSL provider use-after-free

When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership...

OpenSSL provider use-after-free

When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership...

Important: Red Hat Security Advisory: golang security update

An update for golang is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

escort-network-osint

陪护网络OSINT调查 概述 本项目分析跨多个平台的陪护相关列表网络，识别共享基础设施、身份复用和集中协调的模式。 目标 识别个人资料、电话号码与平台之间的关系 检测身份复用和轮换的模式 分析潜在的有组织活动指标 关键发现 电话号码在多个身份间被重复使用 存在单人、双人及团体形式的个人资料 跨平台分发策略 集中协调的强烈迹象 查看完整发现：findings/findings.md 数据结构 rawdata/ → 原始数据集（Excel） entities/ → 结构化实体（电话号码、人员、个人资料、平台） evidences/ → 截图与证据 analysis/ → 分析笔记...

SUSE CVE-2026-84199

Kyverno before 1.16.2 contains a server-side request forgery SSRF vulnerability in the APICall feature. The URL field in a Policy's ServiceCall configuration is not validated, so a user with namespace-level Policy creation permissions can direct Kyverno to make HTTP requests to arbitrary internal...

PT-2026-84654

Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description A heap-use-after-free occurs when using libcurl's multi interface with OpenSSL 3 provider configurations. The issue arises because libcurl attaches an allocated library context to the easy...