gate0

gate0 A small, auditable, terminating, deterministic micro-policy engine. Why Gate0? I built Gate0 because I was tired of debugging RegEx-based policies in production. I wanted something that was boring, bounded, and impossible to crash. If you want a flexible, general-purpose policy engine, you...

next-picomatch-cve-repro

Next.js 번들 picomatch CVE-2026-33671 재현 최소 재현: Next.js 16.2.4는 nodemodules/next/dist/compiled/picomatch/에 벤더링된 picomatch 4.0.3을 포함하며, 이는 CVE-2026-33671HIGH의 영향을 받습니다. npm overrides는 번들된 복사본에 도달할 수 없습니다. 단계 npm install 1. 벤더링된 복사본 검사 cat nodemodules/next/dist/compiled/picomatch/package.json →...

PT-2026-99781

Name of the Vulnerable Software and Affected Versions Modules Anywhere versions 1.5.0 through 9.0.5 Description Modules Anywhere Pro allows additional attributes on a module tag to replace arbitrary parameters of the selected module, a feature enabled by default. These overrides are applied witho...

PT-2026-99284

Name of the Vulnerable Software and Affected Versions capgo.app affected versions not specified Description The transfer app database function fails to delete or revalidate existing rows in channel permission overrides when transferring an app, its channels, versions, and related records to a...

PT-2026-99288

Name of the Vulnerable Software and Affected Versions capgo.app affected versions not specified Description The application fails to validate that principals within channel permission overrides are members of the organization. This allows authenticated app or organization administrators to grant...

CVE-2026-82432 Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides

Description Nimbus validated topology.blobstore.map against the calling subject at submission time only. The rebalance operation accepts configuration overrides and stripped a small set of keys from them, but never re-ran that validation, so a caller authorised to rebalance a topology could...

CVE-2026-82432 Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides

Description Nimbus validated topology.blobstore.map against the calling subject at submission time only. The rebalance operation accepts configuration overrides and stripped a small set of keys from them, but never re-ran that validation, so a caller authorised to rebalance a topology could...

CVE-2026-88860 Capgo Authorization Bypass via Stale Channel Permission Overrides

Capgo fails to clean up channel permission overrides when a user's last organization role binding is deleted, leaving stale overrides active. Attackers can retain channel-specific permissions after their base RBAC access has been revoked to perform unauthorized actions like changing production OT...

EUVD-2026-75410

Capgo fails to clean up channel permission overrides when a user's last organization role binding is deleted, leaving stale overrides active. Attackers can retain channel-specific permissions after their base RBAC access has been revoked to perform unauthorized actions like changing production OT...

CVE-2026-88860

Capgo , an OTA update platform, is affected by an authorization bypass caused by stale channel permission overrides. When a user's last organization role binding is deleted, Capgo fails to clean up associated channel-level permission overrides, leaving them active. An attacker with a previously r...

CVE-2026-88860 Capgo Authorization Bypass via Stale Channel Permission Overrides

Capgo fails to clean up channel permission overrides when a user's last organization role binding is deleted, leaving stale overrides active. Attackers can retain channel-specific permissions after their base RBAC access has been revoked to perform unauthorized actions like changing production OT...

CVE-2026-88860: Incorrect Authorization

Capgo fails to clean up channel permission overrides when a user's last organization role binding is deleted, leaving stale overrides active. Attackers can retain channel-specific permissions after their base RBAC access has been revoked to perform unauthorized actions like changing production OT...

PYSEC-2026-3793

opensslencrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI, allowing attackers to inject control characters and line separators into the irreversible-removal confirmation dialog. Attackers can craft encrypted files with malicious slot identifiers containing bi...

CVE-2026-81685 openssl_encrypt before 1.4.9 Text Injection via Recovery Slot Metadata

opensslencrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI, allowing attackers to inject control characters and line separators into the irreversible-removal confirmation dialog. Attackers can craft encrypted files with malicious slot identifiers containing bi...

PT-2026-82586

openssl encrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI, allowing attackers to inject control characters and line separators into the irreversible-removal confirmation dialog. Attackers can craft encrypted files with malicious slot identifiers containing...

CVE-2026-81685: Improper Encoding or Escaping of Output

opensslencrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI, allowing attackers to inject control characters and line separators into the irreversible-removal confirmation dialog. Attackers can craft encrypted files with malicious slot identifiers containing bi...

EUVD-2026-63950

Incus is a system container and virtual machine manager. Prior to version 7.3.0, when migrating an instance to another cluster member, user-supplied configuration overrides including security-critical keys like security.privileged and raw.lxc are applied without any project restriction enforcemen...

CVE-2026-63296: Incorrect Authorization

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration. When migrating an instance to a target project, LXD accepts configuration overrides without validating the new configuration against the target project's...

Malicious code in idnna (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da6f2ec3b09fbcf061a9f4ffefe1c179983ad8cdc0af705f2218280ade3c1da3 The package publishes under a name that closely resembles the widely-used idna package and advertises itself as 'HTTP client utilities', but the only...

MAL-2026-13487 Malicious code in flasq (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79bdf17d9c07586ddc0b7121037c2c10019d7be01d2dd49685680a8e876342c6 setup.py registers a custom install cmdclass whose post-install hook is stored as a base64-encoded blob and decoded+exec'd at install time. On Linux,...