CVE-2026-73577

Apache OFBiz versions 24.09 before 24.09.08 are vulnerable to an unauthenticated path-suffix view authorization bypass in the RequestHandler . The root cause is incorrect authorization logic where the servlet authorizes a request based on a public path component but renders a protected suffix vie...

CVE-2026-49869

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath.endsWith"/configs" to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match...

CVE-2026-53576 Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API @Filter"/api/v1/" treats any request whose path ends in /configs as the public instance-config endpoint and forwards it without a credential check. kestra addresse...

CVE-2026-4220

A vulnerability has been found in Technologies Integrated Management Platform 7.17.0. Affected by this issue is some unknown functionality of the file /SetWebpagePic.jsp. The manipulation of the argument targetPath/Suffix leads to unrestricted upload. The attack may be initiated remotely. The...

Debian: Security Advisory (DLA-882-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DLA-882-1 : tryton-server security update

It was discovered that there was a path suffix injection attack in tryton-server, a general purpose application platform. For Debian 7 'Wheezy', this issue has been fixed in tryton-server version 2.2.4-1+deb7u4. We recommend that you upgrade your tryton-server packages. NOTE: Tenable Network...