Lucene search
+L

980349 matches found

Cvelist
Cvelist
added 2026/06/22 8:35 p.m.45 views

CVE-2026-41479 Authlib OAuth 2.0 authorization endpoint open redirects to attacker-controlled redirect_uri on unsupported response_type

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.10 and 1.7.1, Authlib's OAuth 2.0 authorization endpoint can be turned into an unauthenticated open redirect when a request uses an unsupported responsetype and supplies an attacker-controlled redirecturi. The...

5.4CVSS0.00257EPSS
SaveExploits1References2
Debian CVE
Debian CVE
added 2026/06/22 8:35 p.m.28 views

CVE-2026-41479

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.10 and 1.7.1, Authlib's OAuth 2.0 authorization endpoint can be turned into an unauthenticated open redirect when a request uses an unsupported responsetype and supplies an attacker-controlled redirecturi. The...

5.4CVSS6AI score0.00257EPSS
SaveExploits1
NVD
NVD
added 2026/06/22 6:16 p.m.19 views

CVE-2026-54285

opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 2.8.0, W3CBaggagePropagator.extract in @opentelemetry/core does not enforce size limits when parsing inbound baggage HTTP headers. The W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries; these limits were...

5.3CVSS0.00344EPSS
SaveExploits0References1
NVD
NVD
added 2026/06/22 6:16 p.m.19 views

CVE-2026-54276

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, DigestAuthMiddleware can send an authentication response after following a cross-origin redirect. This likely requires an open redirect vulnerability or similar on the target domain for an attacker to...

6.3CVSS0.00307EPSS
SaveExploits0References2
UbuntuCve
UbuntuCve
added 2026/06/22 6:16 p.m.11 views

CVE-2026-54276

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, DigestAuthMiddleware can send an authentication response after following a cross-origin redirect. This likely requires an open redirect vulnerability or similar on the target domain for an attacker to...

6.3CVSS6.1AI score0.00307EPSS
SaveExploits0References2
UbuntuCve
UbuntuCve
added 2026/06/22 6:16 p.m.9 views

CVE-2026-54280

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a payload is using an open file or similar limited resource, then an attacker may be able to cause...

7.5CVSS6.1AI score0.00281EPSS
SaveExploits0References2
CVE
CVE
added 2026/06/22 4:52 p.m.110 views

CVE-2026-54285

Opentelemetry-js (OpenTelemetry JavaScript client) is affected by CVE-2026-54285 through the W3CBaggagePropagator.extract() path in @opentelemetry/core prior to 2.8.0, where inbound baggage headers were not capped and could trigger memory allocation proportional to header size. The issue is fixed...

5.3CVSS5.9AI score0.00344EPSS
SaveExploits0References1
OSV
OSV
added 2026/06/22 4:36 p.m.14 views

CVE-2026-54276 AIOHTTP: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, DigestAuthMiddleware can send an authentication response after following a cross-origin redirect. This likely requires an open redirect vulnerability or similar on the target domain for an attacker to...

6.3CVSS5.9AI score
SaveExploits0References4
NVD
NVD
added 2026/06/22 4:16 p.m.20 views

CVE-2026-7664

IBM Langflow OSS 1.0.0 through 1.8.4 could allow unauthenticated attackers to access protected MCP project resources and execute MCP operations due to improper authorization enforcement in the Streamable MCP transport endpoint...

9.8CVSS0.00498EPSS
SaveExploits0References1
RedHat Linux
RedHat Linux
added 2026/06/22 3:51 p.m.15 views

Important: Red Hat Security Advisory: OpenShift Virtualization v4.17 Images

Red Hat OpenShift Virtualization release v4.17 is now available with updates to packages and images that fix several bugs and add enhancements. OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform. This advisory contains OpenShift...

7.7CVSS5.8AI score0.00516EPSS
SaveExploits0References2
RedHat Linux
RedHat Linux
added 2026/06/22 3:13 p.m.12 views

openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key

A flaw was found in openssl. Applications that use RSASVE key encapsulation, a method for securely exchanging encryption keys, may inadvertently expose sensitive data. This vulnerability arises when an application processes a malicious, invalid RSA public key provided by an attacker without prope...

7.5CVSS5.8AI score0.0103EPSS
SaveExploits0References5
OSV
OSV
added 2026/06/22 2:35 p.m.7 views

OPENSUSE-SU-2026:21012-1 Security update for perl-Config-IniFiles

This update for perl-Config-IniFiles fixes the following issue - CVE-2026-11527: OS command injection and file overwrite via a 2-arg open of the -file argument in makefilehandle bsc1268236...

8.6CVSS5.8AI score0.01068EPSS
SaveExploits0References2
OSV
OSV
added 2026/06/22 2:27 p.m.6 views

SUSE-SU-2026:22329-1 Security update for perl-Config-IniFiles

This update for perl-Config-IniFiles fixes the following issue - CVE-2026-11527: OS command injection and file overwrite via a 2-arg open of the -file argument in makefilehandle bsc1268236...

8.6CVSS5.8AI score0.01068EPSS
SaveExploits0References3
IBM Security Bulletins
IBM Security Bulletins
added 2026/06/22 2:26 p.m.10 views

Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-33871 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote...

9.8CVSS6.7AI score0.0115EPSS
SaveExploits1Affected Software1
CVE
CVE
added 2026/06/22 2:10 p.m.31 views

CVE-2026-7664

Summary: IBM Langflow OSS versions 1.0.0–1.8.4 are affected by an unauthenticated access issue due to improper authorization enforcement on the Streamable MCP transport endpoint, potentially allowing access to protected MCP project resources and execution of MCP operations. Affected products/vers...

9.8CVSS5.9AI score0.00498EPSS
SaveExploits0References1Affected Software1
IBM Security Bulletins
IBM Security Bulletins
added 2026/06/22 1:42 p.m.11 views

Security Bulletin: Vulnerability in Apache Tomcat affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in Apache Tomcat has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information...

9.1CVSS6.7AI score0.0885EPSS
SaveExploits4Affected Software2
IBM Security Bulletins
IBM Security Bulletins
added 2026/06/22 1:41 p.m.14 views

Security Bulletin: Vulnerability in Apache Tomcat affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in Apache Tomcat has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information...

9.1CVSS6.5AI score0.00715EPSS
SaveExploits2Affected Software2
EUVD
EUVD
added 2026/06/22 1:22 p.m.18 views

EUVD-2026-38245

IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an improper isolation of Python execution combined with an authentication bypass that allows an unauthenticated attacker to execute arbitrary code on the host system, resulting in complete compromise...

10CVSS6.4AI score0.00914EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/06/22 12:46 p.m.14 views

EUVD-2026-38233

A flaw was found in the Windows Machine Config Operator WMCO for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validates that a Certificate Signing Request contains the organization system:wicd-nodes but does not reject additional organization values such as system:masters. A...

8.8CVSS5.8AI score0.0011EPSS
SaveExploits0References2
RedHat Linux
RedHat Linux
added 2026/06/22 12:41 p.m.13 views

Important: Red Hat Security Advisory: OpenShift Virtualization v4.21 Images

Red Hat OpenShift Virtualization release v4.21 is now available with updates to packages and images that fix several bugs and add enhancements. OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform. This advisory contains OpenShift...

9.1CVSS7.3AI score0.01557EPSS
SaveExploits1References2
Rows per page
Query Builder