12868 matches found
EUVD-2026-9501
Vaultwarden has 2FA Bypass on Protected Actions due to Faulty Rate Limit Enforcement...
GHSA-V6PG-V89R-W8WR Vaultwarden has 2FA Bypass on Protected Actions due to Faulty Rate Limit Enforcement
Summary Vaultwarden v1.34.3 and prior are susceptible to a 2FA bypass when performing protected actions. An attacker who gains authenticated access to a users account can exploit this bypass to perform protected actions such as accessing the user's API key or deleting the user's vault and...
Hono vulnerable to arbitrary file access via serveStatic vulnerability
Summary When using serveStatic together with route-based middleware protections e.g. app.use'/admin/', ..., inconsistent URL decoding allowed protected static resources to be accessed without authorization. The router used decodeURI, while serveStatic used decodeURIComponent. This mismatch allowe...
SUSE CVE-2026-25232
Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have an access control bypass vulnerability which allows any repository collaborator with Write permissions to delete protected branches including the default branch by sending a direct POST request, completely bypassing th...
Hono 安全漏洞
Hono is a web framework written in TypeScript for the Hono community. Versions of Hono prior to 4.12.4 contained security vulnerabilities. These vulnerabilities stemmed from inconsistent URL decoding when using serveStatic and routing-based middleware protections. This allowed paths containing...
ROS-20260304-73-0006
A vulnerability in the skisreadable function of the Linux kernel is related to null pointer dereferencing. Exploitation of the vulnerability may allow a remote attacker to affect the availability of protected information...
ROS-20260304-73-0007
A vulnerability in the foreachpossiblecpu function of the Linux kernel is related to null pointer dereferencing. Exploitation of the vulnerability may allow a remote attacker to affect the availability of protected information...
ROS-20260304-73-0029
A vulnerability in the dbMount function of the Linux kernel is related to reading memory outside of the allocated buffer. Exploitation of the vulnerability could allow a remote attacker to affect the confidentiality of protected information...
The vulnerability of the /goform/getHomePageInfo function in the microprogramming software for Pix-Link LV-WR21Q allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the /goform/getHomePageInfo function in the microprogramming software for Pix-Link LV-WR21Q routers is related to the absence of authentication for critical functions. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...
Vaultwarden 安全漏洞
Vaultwarden is an alternative implementation of the Bitwarden server API, developed by Daniel García. Versions of Vaultwarden 1.34.3 and earlier contained security vulnerabilities. These vulnerabilities stemmed from the ability to bypass two-factor authentication when performing protected...
ROS-20260304-73-0026
A vulnerability in the v4l2rectmapinside function of the Linux kernel is related to memory reads outside of the allocated buffer. Exploitation of the vulnerability may allow an attacker acting remotely to affect the confidentiality of protected information...
CVE-2026-27932
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. In 1.6.2 and earlier, a resource exhaustion vulnerability in joserfc allows an unauthenticated attacker to cause a Denial of Service DoS via CPU exhaustion. When the library...
CVE-2026-24898 OpenEMR has an Unauthenticated MedEx Token Disclosure
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0, an unauthenticated token disclosure vulnerability in the MedEx callback endpoint allows any unauthenticated visitor to obtain the practice's MedEx API tokens, leading to comple...
Directory Traversal
Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Directory Traversal via the gateway plugin authentication. An attacker can gain unauthorized access to protected API channel routes by sending requests with encoded dot-segment traversal ...
OpenEMR 授权问题漏洞
OpenEMR is a set of open-source medical management systems developed by the OpenEMR community. This system can be used for medical practice management, electronic medical records, prescription writing, and medical billing applications. Versions of OpenEMR prior to 8.0.0 contained vulnerabilities...
GHSA-W5R5-M38G-F9F9 joserfc's PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS)
Summary A resource exhaustion vulnerability in joserfc allows an unauthenticated attacker to cause a Denial of Service DoS via CPU exhaustion. When the library decrypts a JSON Web Encryption JWE token using Password-Based Encryption PBES2 algorithms, it reads the p2c PBES2 Count parameter directl...
BIT-GITLAB-2026-1747 Authentication Bypass Using an Alternate Path or Channel in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 17.11 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that, under certain conditions, could have allowed Developer-role users with insufficient privileges to make unauthorized modifications to protected Conan packag...
Apple macOS Tahoe Information Disclosure Vulnerability (CNVD-2026-14994)
Apple macOS Tahoe is an operating system from the American company Apple. Apple macOS Tahoe suffers from an information disclosure vulnerability that can be exploited by attackers to cause an application to access protected user data...
The vulnerability of the Odoo Community Edition CRM system and the Odoo Enterprise Edition ERP system, related to lack of access control, allows a intruder to gain unauthorized access to protected information.
The vulnerability of the CRM system Odoo Community Edition and the ERP system Odoo Enterprise Edition is related to deficiencies in access control. Exploiting these vulnerabilities can allow unauthorized individuals to gain unauthorized access to protected information...