59752 matches found
CVE-2026-63737 SurrealDB before 3.1.5 Denial of Service via deep operator chains
SurrealDB versions before 3.1.5 contain a denial of service vulnerability where authenticated users can crash the server with queries containing long chains of operators. Attackers can submit queries with tens of thousands of chained operators that create unbounded expression trees, causing stack...
CVE-2026-6656
Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks. The checkpassword method uses the built-in eq operator. This allows discrepancies in timing to be used to guess the underlying hash...
PT-2026-61553
Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.1.5 Description Authenticated users can cause a denial of service by submitting queries containing long chains of operators. This occurs when tens of thousands of chained operators create unbounded expression tree...
CVE-2026-56742 vulnerabilities
Vulnerabilities for packages: kubescape-server-fips, hubble-ui-backend-fips, kubescape-operator, kubescape-server, hubble, hubble-ui, kubescape, kubescape-operator-fips, hubble-fips...
Authentication Bypass
netlicensing-mcp is vulnerable to Authentication Bypass. The vulnerability is due to the API key middleware failing to enforce authentication and falling back to the server operator's API key, which allows an unauthenticated attacker to invoke privileged MCP operations under the operator's identi...
GO-2026-5991 nebula-mesh: Operator session tokens stored in plaintext in the database in github.com/forgekeep/nebula-mesh
nebula-mesh: Operator session tokens stored in plaintext in the database in github.com/forgekeep/nebula-mesh...
GO-2026-5998 open-feature-operator: Cross-namespace FeatureFlagSource and InProcessConfiguration resolution exposes spec contents on multi-tenant clusters in github.com/open-feature/open-feature-operator
open-feature-operator: Cross-namespace FeatureFlagSource and InProcessConfiguration resolution exposes spec contents on multi-tenant clusters in github.com/open-feature/open-feature-operator...
GHSA-2V2F-MVFG-PH56 meta-ads-mcp: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token
X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token Summary AuthInjectionMiddleware in meta-ads-mcp rejects HTTP MCP requests only when both authtoken and pipeboardtoken are absent. Because extracttokenfromheaders does not recognise the X-Pipeboard-Token header, an attacker who sends...
meta-ads-mcp: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token
X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token Summary AuthInjectionMiddleware in meta-ads-mcp rejects HTTP MCP requests only when both authtoken and pipeboardtoken are absent. Because extracttokenfromheaders does not recognise the X-Pipeboard-Token header, an attacker who sends...
CVE-2026-44722
pyzipper is a replacement for Python's zipfile that can read and write AES encrypted zip files. Prior to 0.4.0, a Python operator precedence bug in pyzipper/zipfileaes.py caused the AE-2 format to never be automatically selected during encryption, causing encrypted entries to be written in AE-1...
CVE-2026-44722 pyzipper: Encryption bypass for small files encrypted with pyzipper
pyzipper is a replacement for Python's zipfile that can read and write AES encrypted zip files. Prior to 0.4.0, a Python operator precedence bug in pyzipper/zipfileaes.py caused the AE-2 format to never be automatically selected during encryption, causing encrypted entries to be written in AE-1...
CVE-2026-63100
Maybe through 0.6.0 contains a missing authorization vulnerability that allows authenticated low-privilege member-role users to access and modify global hosting settings by exploiting unprotected show and update actions in the Settings::HostingsController, where the beforeaction ensureadmin filte...
CVE-2026-49211 Symfony UX: Information exposure via unescaped LIKE wildcards in EntitySearchUtil
Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, Symfony\UX\Autocomplete\Doctrine\EntitySearchUtil::addSearchClause builds the LIKE expression used by the autocomplete endpoint by wrapping the client-supplied query in %...% without escaping SQL LIKE wildcards %...
Exposure Of Sensitive Information
github.com/forgekeep/nebula-mesh is vulnerable to Exposure of Sensitive Information. The vulnerability is due to operator session tokens being stored in plaintext in the database rather than in a protected or hashed form, which allows an attacker with access to the database e.g., through backups,...
CVE-2026-53715 vulnerabilities
Vulnerabilities for packages: datadog-agent-fips, tigera-operator, gitlab-operator-fips, tigera-operator-fips, gitlab-operator, datadog-agent...
CVE-2026-53717 vulnerabilities
Vulnerabilities for packages: datadog-agent-fips, tigera-operator, gitlab-operator-fips, tigera-operator-fips, gitlab-operator, datadog-agent...
GHSA-8FV2-88GG-HM7Q vulnerabilities
Vulnerabilities for packages: datadog-agent-fips, tigera-operator, gitlab-operator-fips, tigera-operator-fips, gitlab-operator, datadog-agent...
GHSA-CXPQ-8V7Q-CG56 vulnerabilities
Vulnerabilities for packages: datadog-agent-fips, tigera-operator, gitlab-operator-fips, tigera-operator-fips, gitlab-operator, datadog-agent...