168508 matches found
Statamic: Account takeover via OAuth email matching without email-verification check
Impact When OAuth login is enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user — potentially including a super admin — without their password. Exploitation requires OAuth to be explicitly enabled with such a...
Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence
Impact An authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belongs to an existing user, without having permission to view users. The endpoint only exposed user existence, not any of its data. Patches This has been...
Traefik: Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth
Summary There is a high severity vulnerability in Traefik's BasicAuth, DigestAuth, and ForwardAuth middlewares. The fix for CVE-2026-33433 stripped canonical-cased spoofed identity headers e.g. X-Auth-User before writing Traefik's own value, but did not account for underscore-variant header names...
GHSA-X677-9FXG-V5C5 Traefik: Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth
Summary There is a high severity vulnerability in Traefik's BasicAuth, DigestAuth, and ForwardAuth middlewares. The fix for CVE-2026-33433 stripped canonical-cased spoofed identity headers e.g. X-Auth-User before writing Traefik's own value, but did not account for underscore-variant header names...
Traefik: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass
Summary There is a high severity vulnerability in Traefik's Kubernetes Ingress NGINX provider. When an Ingress uses the nginx.ingress.kubernetes.io/rewrite-target annotation with a regular expression that captures attacker-controlled text without requiring a path separator for example path /api...
ROOT-APP-NPM-CVE-2024-21534 CVE-2024-21534 in jsonpath-plus - Patched by Root
Root has patched CVE-2024-21534 in the jsonpath-plus package for Root:npm. Multiple fixed versions available...
CVE-2026-19041
A vulnerability has been found in MissionSquad mcp-api up to 1.11.8. The impacted element is the function this.packageService.installPackage of the file src/controllers/packages.ts of the component NPM Package Version Handler. The manipulation leads to command injection. It is possible to initiat...
EUVD-2026-53927
A vulnerability has been found in MissionSquad mcp-api up to 1.11.8. The impacted element is the function this.packageService.installPackage of the file src/controllers/packages.ts of the component NPM Package Version Handler. The manipulation leads to command injection. It is possible to initiat...
CVE-2026-19041 MissionSquad mcp-api NPM Package Version packages.ts this.packageService.installPackage command injection
A vulnerability has been found in MissionSquad mcp-api up to 1.11.8. The impacted element is the function this.packageService.installPackage of the file src/controllers/packages.ts of the component NPM Package Version Handler. The manipulation leads to command injection. It is possible to initiat...
Malicious code in agenttunnels (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 264711675c5edabf4f3d0b1d544ca8bade34057c973ca614c82bca3cf8bdd5a1 agenttunnels ships an MCP bridge whose customer-role tools accept payloads from a remote session worker agenttunnels-session.lakshman111.workers.dev...
CVE-2026-19038
CVE-2026-19038 affects MonomythDevelopment la-forge-mcp 1.0.0, specifically the screenshotElement function in src/index.ts of the screenshot_element Tool. The issue arises from manipulation of the argument output_name, enabling path traversal. The vulnerability is exploitable remotely via a netwo...
ROOT-OS-ALPINE-322-CVE-2025-69649 CVE-2025-69649 in binutils - Patched by Root
Root has patched CVE-2025-69649 in the binutils package for Root:Alpine:3.22. Multiple fixed versions available...
ROOT-OS-ALPINE-322-CVE-2026-3442 CVE-2026-3442 in binutils - Patched by Root
Root has patched CVE-2026-3442 in the binutils package for Root:Alpine:3.22. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2019-5413 CVE-2019-5413 in morgan - Patched by Root
Root has patched CVE-2019-5413 in the morgan package for Root:npm. Multiple fixed versions available...
EUVD-2026-53855
The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the chash parameter when operating in the Hybrid Flow. If an Apache CXF RP is integrated with a non-compliant or misconfigured Identity Provider IdP that omits the chash, the RP becomes vulnerable to Authorization Code...
ROOT-APP-NPM-CVE-2015-9235 CVE-2015-9235 in jsonwebtoken - Patched by Root
Root has patched CVE-2015-9235 in the jsonwebtoken package for Root:npm. Multiple fixed versions available...
ROOT-OS-ALPINE-321-CVE-2026-11822 CVE-2026-11822 in sqlite - Patched by Root
Root has patched CVE-2026-11822 in the sqlite package for Root:Alpine:3.21. Multiple fixed versions available...
CVE-2026-19008 mf-yang openclaw-cn apply_patch Tool sandbox-paths.ts assertNoSymlinkEscape link following
A vulnerability was identified in mf-yang openclaw-cn up to 0.2.1. This issue affects the function assertNoSymlinkEscape of the file src/agents/sandbox-paths.ts of the component applypatch Tool. Such manipulation leads to link following. It is possible to launch the attack remotely. The exploit i...
CVE-2026-19008 mf-yang openclaw-cn apply_patch Tool sandbox-paths.ts assertNoSymlinkEscape link following
A vulnerability was identified in mf-yang openclaw-cn up to 0.2.1. This issue affects the function assertNoSymlinkEscape of the file src/agents/sandbox-paths.ts of the component applypatch Tool. Such manipulation leads to link following. It is possible to launch the attack remotely. The exploit i...
