Traefik: BasicAuth singleflight key collision allows authenticated identity spoofing

Summary There is a low severity vulnerability in Traefik's BasicAuth middleware. Concurrent password verifications are deduplicated through a singleflight group whose key was the delimiter-free concatenation of the submitted password and the stored secret, so a request carrying an unconfigured...

EUVD-2026-32584

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.12.0, /api/totpsetup.php is callable from a session that has only passed the password check state pendingloginuser. When the target account already has TOTP configured, the endpoint...

PT-2019-11744 · Jenkins · Jenkins Configuration As Code Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Configuration as Code Plugin versions 1.20 and earlier Jenkins Configuration as Code Plugin versions prior to 1.25 Description: The issue concerns the handling of the proxy password in the Jenkins Configuration as Code Plugin...