44353 matches found
EUVD-2026-61098
Kurrier is a modern, self-hosted workspace for email, calendar, contacts, and storage. Prior to 1.2.4, Kurrier API endpoints for listing and retrieving webhook and identity resources did not enforce ownership checks for authenticated API requests. An attacker with a valid API key could use anothe...
CVE-2026-55106
authentik's LDAP Source API diagnostic action bypasses object-level read-authorization, letting unauthenticated clients trigger upstream LDAP queries using the source's bind credentials. The response exposes DNs and attribute names (not values), revealing directory structure, naming conventions, ...
CVE-2026-55106 authentik: Unauthenticated LDAP directory data disclosure
authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, a diagnostic action on the LDAP Source API does not enforce the object-level read-authorization filter used by the rest of the API. Any party able to reach the API, including an unauthenticated client, can invoke the...
CVE-2026-55106 authentik: Unauthenticated LDAP directory data disclosure
authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, a diagnostic action on the LDAP Source API does not enforce the object-level read-authorization filter used by the rest of the API. Any party able to reach the API, including an unauthenticated client, can invoke the...
SUSE CVE-2026-68131
In the Linux kernel, the following vulnerability has been resolved: rbd: Reset positive result codes to zero in object map update path In a reply message to an RBD request, a positive result code indicates a data payload, which is not allowed for writes. While rbdosdreqcallback already resets a...
CVE-2026-75485
A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect redaction that would normally sanitize sensitive fields. This exposes proxy basic-auth credentials in the must-gather...
CVE-2026-74012
Deserialization of Untrusted Data vulnerability in TaxoPress allows Object Injection. This issue affects TaxoPress: from n/a through 3.51.0...
CVE-2026-73380
Unauthenticated PHP Object Injection in Popup by Supsystic = 1.13.0 versions...
CVE-2026-73376
Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic 1.5.0 versions...
CVE-2026-73366
Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...
CVE-2026-73189
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate to CVE-2026-14858...
CVE-2026-73341
Unauthenticated PHP Object Injection in RegistrationMagic = 6.0.9.7 versions...
CVE-2026-66620
Editor PHP Object Injection in OptionTree = 2.7.3 versions...
CVE-2026-32470
Unauthenticated PHP Object Injection in FundEngine = 1.7.9 versions...
CVE-2026-75485 Must-gather: /tmp/kubeconfig retention
A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect redaction that would normally sanitize sensitive fields. This exposes proxy basic-auth credentials in the must-gather...
CVE-2026-75485
A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect redaction that would normally sanitize sensitive fields. This exposes proxy basic-auth credentials in the must-gather...
CVE-2026-75485
In Red Hat Advanced Cluster Management for Kubernetes, the must-gather component dumps the cluster Proxy object raw, bypassing oc inspect redaction and exposing proxy basic-auth credentials in the archive. CVSS 5.5 (MEDIUM), local exploit, no in-the-wild exploitation reported. Monitor Red Hat adv...
EUVD-2026-60959
A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect redaction that would normally sanitize sensitive fields. This exposes proxy basic-auth credentials in the must-gather...
CVE-2026-72359
A flaw was found in the Linux kernel's drm/xe graphics driver. A local user could trigger a NULL pointer dereference when querying memory statistics for a buffer object that has been purged. This issue arises because the driver attempts to access a NULL resource, which can lead to a system crash...