26 matches found
CVE-2026-88017
rclone versions 1.64.0 through 1.75.1 contain a cross-session authentication confusion in the FTP auth-proxy driver (cmd/serve/ftp/ftp.go). The server stores one obscured password per username in a global userPass map rather than binding it to the authenticated session. When a second login with t...
CVE-2026-88017
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the server-wide userPass mapstringstring instead of binding the...
PT-2026-89488
Name of the Vulnerable Software and Affected Versions rclone versions 1.64.0 through 1.75.0 Description The FTP auth-proxy driver in cmd/serve/ftp/ftp.go fails to bind credentials or the Virtual File System VFS to specific authenticated sessions. Instead, it stores one obscured password per...
CVE-2026-57218
A flaw was found in RabbitMQ. An existing consumer in RabbitMQ AMQP 0-9-1 can continue to receive messages even after its OAuth token has expired or its connection's scopes have been reduced. This occurs because consumers are not properly canceled or reauthorized when the channel user state...
Linux Distros Unpatched Vulnerability : CVE-2026-57218
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, RabbitMQ AMQP 0-9-1 allows an existing consumer to keep receiving messages after OAuth token expir...
AZL-92346 CVE-2026-57218 affecting package rabbitmq-server for versions less than 3.13.7-8
RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, RabbitMQ AMQP 0-9-1 allows an existing consumer to keep receiving messages after OAuth token expiry or connection.updatesecret refresh to reduced scopes because existing consumers are not canceled or reauthorized at delivery time after...
UBUNTU-CVE-2026-57218
RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, RabbitMQ AMQP 0-9-1 allows an existing consumer to keep receiving messages after OAuth token expiry or connection.updatesecret refresh to reduced scopes because existing consumers are not canceled or reauthorized at delivery time after...
rabbitmq-server: RabbitMQ: Information disclosure due to improper consumer reauthorization
A flaw was found in RabbitMQ. An existing consumer in RabbitMQ AMQP 0-9-1 can continue to receive messages even after its OAuth token has expired or its connection's scopes have been reduced. This occurs because consumers are not properly canceled or reauthorized when the channel user state...
rabbitmq-server: RabbitMQ: Information disclosure due to improper consumer reauthorization
A flaw was found in RabbitMQ. An existing consumer in RabbitMQ AMQP 0-9-1 can continue to receive messages even after its OAuth token has expired or its connection's scopes have been reduced. This occurs because consumers are not properly canceled or reauthorized when the channel user state...
CVE-2026-8327 Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass.
Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass. The user-profile edit controller passes the entire raw POST array to UserInfo::update without field whitelisting resulting in password change without requiring the current...
Trump Loyalists Kill Vote on US Wiretap Program
An attempt to reauthorize Section 702, the so-called crown jewel of US spy powers, failed for a third time in the House of Representatives after former president Donald Trump criticized the law...
Congress Clashes Over the Future of America’s Section 702 Spy Program
Competing bills moving through the House of Representatives both reauthorize Section 702 surveillance—but they pave very different paths forward for Americans’ privacy and civil liberties...
Section 702 Surveillance Reauthorization May Get Slipped Into ‘Must-Pass’ NDAA
Congressional leaders are discussing ways to reauthorize Section 702 surveillance, including by attaching it to the National Defense Authorization Act, Capitol Hill sources tell WIRED...
US Privacy Groups Urge Senate Not to Ram Through NSA Spying Powers
An effort to reauthorize a controversial US surveillance program by attaching it to a must-pass spending bill has civil liberties advocates calling foul...
Key Caching behavior in the DynamoDB Encryption Client.
Impact This advisory concerns users of MostRecentProvider in the DynamoDB Encryption Client with a key provider like AWS Key Management Service that allows for permissions on keys to be modified. When key usage permissions were changed at the key provider, time-based key reauthorization logic in...
GHSA-4PH2-8337-HM62 Key Caching behavior in the DynamoDB Encryption Client.
Impact This advisory concerns users of MostRecentProvider in the DynamoDB Encryption Client with a key provider like AWS Key Management Service that allows for permissions on keys to be modified. When key usage permissions were changed at the key provider, time-based key reauthorization logic in...
Key Caching behavior in the DynamoDB Encryption Client.
Impact This advisory concerns users of MostRecentProvider in the DynamoDB Encryption Client with a key provider like AWS Key Management Service that allows for permissions on keys to be modified. When key usage permissions were changed at the key provider, time-based key reauthorization logic in...
GHSA-W736-HF9P-QQH3 Key Caching behavior in the DynamoDB Encryption Client.
Impact This advisory concerns users of MostRecentProvider in the DynamoDB Encryption Client with a key provider like AWS Key Management Service that allows for permissions on keys to be modified. When key usage permissions were changed at the key provider, time-based key reauthorization logic in...
PT-2021-24379
Name of the Vulnerable Software and Affected Versions: DynamoDB Encryption Client versions prior to 1.3.0 Description: The issue concerns users of MostRecentProvider in the DynamoDB Encryption Client with a key provider like AWS Key Management Service that allows for permissions on keys to be...
PT-2021-24464
Name of the Vulnerable Software and Affected Versions: DynamoDB Encryption Client versions prior to 1.15.0 Description: The issue concerns users of MostRecentProvider in the DynamoDB Encryption Client with a key provider like AWS Key Management Service. When key usage permissions were changed at...