17122 matches found
GTI-MSEMP Framework : A Proposed Framework to Stimulate Malware Propagation with Inclusion of Attacker-Defender Strategy
The rapid proliferation of automated, multi-vector malware threats poses a significant risk to heterogeneous, resource constrained cyber-physical networks. Conventional epidemiological models often treat security defenses as static parameters, failing to capture the strategic, asymmetric maneuver...
PT-2026-52980
Name of the Vulnerable Software and Affected Versions Kestra versions prior to 1.0.45 Kestra versions prior to 1.3.23 Description The local internal-storage backend fails to properly validate user-supplied paths because it checks for directory traversal sequences before converting Windows-style...
CVE-2026-49984: Improper Limitation of a Pathname to a Restricted Directory
Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.23, the local internal-storage backend validates user-supplied paths for .. traversal before it converts Windows-style backslashes to forward slashes. An attacker can therefore smuggle a traversal sequence past...
CVE-2026-49991: Improper Limitation of a Pathname to a Restricted Directory
RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users with only PutObject permission on their own bucket can exploit a path traversal vulnerability in the Snowball auto-extract feature to write arbitrary objects into other users' buckets, completely...
PT-2026-52909
Name of the Vulnerable Software and Affected Versions RustFS version 1.0.0-beta.4 Description Authenticated users with PutObject permission on their own bucket can exploit a path traversal issue in the Snowball auto-extract feature to write arbitrary objects into buckets belonging to other users,...
PT-2026-53017
Name of the Vulnerable Software and Affected Versions turso-cli affected versions not specified Description the turso-cli tool stores the user's platform JSON Web Token JWT in a settings.json file using default file permissions of 0o644. This configuration makes the credential file world-readable...
Allocation of Resources Without Limits or Throttling
Overview MessagePack is a MessagePackMsgPack Serializer for C.NET, .NET Core, Unity, Xamarin. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the deserialization process for multi-dimensional arrays. An attacker can cause excessive memor...
MessagePack-CSharp: Multi-dimensional array formatters allocate from unchecked dimensions
Summary MessagePack-CSharp's multi-dimensional array formatters read dimension lengths directly from the payload and allocate T,, T,,, or T,,, before validating that the dimension product matches the encoded element count. The formatter reads a guarded element array header, but allocation of the...
EUVD-2026-38381
MessagePack-CSharp: Multi-dimensional array formatters allocate from unchecked dimensions...
Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission
A flaw in the handling of recovery codes for app-based multi-factor authentication allows the same recovery code to be reused via concurrent submission. This issue does not affect email-based MFA. It also only applies when recovery codes are enabled. If an attacker gains access to both the user's...
EUVD-2026-38392
Filament: Multi-factor authentication app recovery codes can still be used multiple times via concurrent submission...
GHSA-MC5J-F6WX-H9QH Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission
A flaw in the handling of recovery codes for app-based multi-factor authentication allows the same recovery code to be reused via concurrent submission. This issue does not affect email-based MFA. It also only applies when recovery codes are enabled. If an attacker gains access to both the user's...
GO-2026-5373 Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs) in github.com/radius-project/radius
Radius Controller May Delete a Container Resource via an Injected Deployment Annotation Multi-Tenant Installs in github.com/radius-project/radius...
GO-2026-5371 Kyverno APICall SSRF Vulnerability Leading to Multi-Tenant Isolation Breach in github.com/kyverno/kyverno
Kyverno APICall SSRF Vulnerability Leading to Multi-Tenant Isolation Breach in github.com/kyverno/kyverno...
GO-2026-5290 Axonflow fixed bugs by implementing multi-tenant isolation and access-control hardening in github.com/getaxonflow/axonflow
Axonflow fixed bugs by implementing multi-tenant isolation and access-control hardening in github.com/getaxonflow/axonflow...
GO-2026-5226 Oxia's TLS CA certificate chain validation fails with multi-certificate PEM bundles in github.com/oxia-db/oxia
Oxia's TLS CA certificate chain validation fails with multi-certificate PEM bundles in github.com/oxia-db/oxia...
[SECURITY] Fedora 43 Update: goose-1.36.0-1.fc43
Goose is your on-machine AI agent, capable of automating complex development tasks from start to finish. More than just code suggestions, goose can build entire projects from scratch, write and execute code, debug failures, orchestrate workflows, and interact with external APIs - autonomously...
[SECURITY] Fedora 44 Update: goose-1.36.0-1.fc44
Goose is your on-machine AI agent, capable of automating complex development tasks from start to finish. More than just code suggestions, goose can build entire projects from scratch, write and execute code, debug failures, orchestrate workflows, and interact with external APIs - autonomously...
