23 matches found
CVE-2026-88017
rclone versions 1.64.0 through 1.75.1 contain a cross-session authentication confusion in the FTP auth-proxy driver (cmd/serve/ftp/ftp.go). The server stores one obscured password per username in a global userPass map rather than binding it to the authenticated session. When a second login with t...
PT-2026-89488
Name of the Vulnerable Software and Affected Versions rclone versions 1.64.0 through 1.75.0 Description The FTP auth-proxy driver in cmd/serve/ftp/ftp.go fails to bind credentials or the Virtual File System VFS to specific authenticated sessions. Instead, it stores one obscured password per...
CVE-2026-57218
A flaw was found in RabbitMQ. An existing consumer in RabbitMQ AMQP 0-9-1 can continue to receive messages even after its OAuth token has expired or its connection's scopes have been reduced. This occurs because consumers are not properly canceled or reauthorized when the channel user state...
Linux Distros Unpatched Vulnerability : CVE-2026-57218
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, RabbitMQ AMQP 0-9-1 allows an existing consumer to keep receiving messages after OAuth token expir...
AZL-92346 CVE-2026-57218 affecting package rabbitmq-server for versions less than 3.13.7-8
RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, RabbitMQ AMQP 0-9-1 allows an existing consumer to keep receiving messages after OAuth token expiry or connection.updatesecret refresh to reduced scopes because existing consumers are not canceled or reauthorized at delivery time after...
UBUNTU-CVE-2026-57218
RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, RabbitMQ AMQP 0-9-1 allows an existing consumer to keep receiving messages after OAuth token expiry or connection.updatesecret refresh to reduced scopes because existing consumers are not canceled or reauthorized at delivery time after...
rabbitmq-server: RabbitMQ: Information disclosure due to improper consumer reauthorization
A flaw was found in RabbitMQ. An existing consumer in RabbitMQ AMQP 0-9-1 can continue to receive messages even after its OAuth token has expired or its connection's scopes have been reduced. This occurs because consumers are not properly canceled or reauthorized when the channel user state...
rabbitmq-server: RabbitMQ: Information disclosure due to improper consumer reauthorization
A flaw was found in RabbitMQ. An existing consumer in RabbitMQ AMQP 0-9-1 can continue to receive messages even after its OAuth token has expired or its connection's scopes have been reduced. This occurs because consumers are not properly canceled or reauthorized when the channel user state...
CVE-2026-8327 Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass.
Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass. The user-profile edit controller passes the entire raw POST array to UserInfo::update without field whitelisting resulting in password change without requiring the current...
Trump Loyalists Kill Vote on US Wiretap Program
An attempt to reauthorize Section 702, the so-called crown jewel of US spy powers, failed for a third time in the House of Representatives after former president Donald Trump criticized the law...
Congress Clashes Over the Future of America’s Section 702 Spy Program
Competing bills moving through the House of Representatives both reauthorize Section 702 surveillance—but they pave very different paths forward for Americans’ privacy and civil liberties...
Section 702 Surveillance Reauthorization May Get Slipped Into ‘Must-Pass’ NDAA
Congressional leaders are discussing ways to reauthorize Section 702 surveillance, including by attaching it to the National Defense Authorization Act, Capitol Hill sources tell WIRED...
US Privacy Groups Urge Senate Not to Ram Through NSA Spying Powers
An effort to reauthorize a controversial US surveillance program by attaching it to a must-pass spending bill has civil liberties advocates calling foul...
GHSA-4PH2-8337-HM62 Key Caching behavior in the DynamoDB Encryption Client.
Impact This advisory concerns users of MostRecentProvider in the DynamoDB Encryption Client with a key provider like AWS Key Management Service that allows for permissions on keys to be modified. When key usage permissions were changed at the key provider, time-based key reauthorization logic in...
Key Caching behavior in the DynamoDB Encryption Client.
Impact This advisory concerns users of MostRecentProvider in the DynamoDB Encryption Client with a key provider like AWS Key Management Service that allows for permissions on keys to be modified. When key usage permissions were changed at the key provider, time-based key reauthorization logic in...
Key Caching behavior in the DynamoDB Encryption Client.
Impact This advisory concerns users of MostRecentProvider in the DynamoDB Encryption Client with a key provider like AWS Key Management Service that allows for permissions on keys to be modified. When key usage permissions were changed at the key provider, time-based key reauthorization logic in...
GHSA-W736-HF9P-QQH3 Key Caching behavior in the DynamoDB Encryption Client.
Impact This advisory concerns users of MostRecentProvider in the DynamoDB Encryption Client with a key provider like AWS Key Management Service that allows for permissions on keys to be modified. When key usage permissions were changed at the key provider, time-based key reauthorization logic in...
Key Caching behavior in the DynamoDB Encryption Client.
Impact This advisory concerns users of MostRecentProvider in the DynamoDB Encryption Client with a key provider like AWS Key Management Service that allows for permissions on keys to be modified. When key usage permissions were changed at the key provider, time-based key reauthorization logic in...
Newly Declassified Study Demonstrates Uselessness of NSA's Phone Metadata Program
The New York Times is reporting on the NSA's phone metadata program, which the NSA shut down last year: A National Security Agency system that analyzed logs of Americans' domestic phone calls and text messages cost $100 million from 2015 to 2019, but yielded only a single significant investigatio...
After Section 702 Reauthorization
For over a decade, civil libertarians have been fighting government mass surveillance of innocent Americans over the Internet. We've just lost an important battle. On January 18, President Trump signed the renewal of Section 702, domestic mass surveillance became effectively a permanent part of U...