150179 matches found
Authorization Bypass Through User-Controlled Key
Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the internal completion callback process. An attacker can alter schedule state across namespaces by attaching a forged callback to a workflow start request, enabling unauthorized...
Authorization Bypass Through User-Controlled Key
Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the internal completion callback process. An attacker can alter schedule state across namespaces by attaching a forged callback to a workflow start request, enabling unauthorized...
Authorization Bypass Through User-Controlled Key
Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the internal completion callback process. An attacker can alter schedule state across namespaces by attaching a forged callback to a workflow start request, enabling unauthorized...
Authorization Bypass Through User-Controlled Key
Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the internal completion callback process. An attacker can alter schedule state across namespaces by attaching a forged callback to a workflow start request, enabling unauthorized...
CVE-2026-66877
Workflow runs from first-time fork contributors are held for maintainer approval only by inserting the run's jobs in a blocked state. The component that transitions blocked jobs to waiting does not re-check whether the run still needs approval. A separate, legitimate run in the same repository th...
CVE-2026-92120
OAuth1 Request Replay Attack vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0 which fixes the issue...
EUVD-2026-97832
OAuth1 Request Replay Attack vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0 which fixes the issue...
CVE-2026-41504 OWASP Coraza WAF: Native audit-log format allows CRLF injection and log forgery via request body and header fields
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the Native audit-log formatter in internal/auditlog/formats.go writes attacker-influenced request and response fields without neutralizing carriage returns or line feeds. When...
CVE-2026-41504
The OWASP Coraza WAF library (versions 3.0.0 through 3.7.0 ) is vulnerable to CRLF injection within its Native audit-log formatter. Specifically, the file internal/auditlog/formats.go fails to neutralize carriage returns ( ) and line feeds ( ) in attacker-influenced request/response bodies, heade...
CVE-2026-41504 OWASP Coraza WAF: Native audit-log format allows CRLF injection and log forgery via request body and header fields
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the Native audit-log formatter in internal/auditlog/formats.go writes attacker-influenced request and response fields without neutralizing carriage returns or line feeds. When...
Exploit for CVE-2026-84411
CVE-2026-84411 — reproduction & PoC Pre-auth integer underflo...
EUVD-2026-97730
Cross-Site Request Forgery CSRF vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.9.17...
CVE-2026-109319
Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-site request forgery vulnerabilities in Admin moderation actions delete, approve, and approveAll. Authenticated Admin users lacking the admin.guestbook permission, or external sites abusing a moderator's session via...
CVE-2026-108909
A security flaw has been discovered in Netcore NR268 1.7.121109. Affected by this issue is some unknown functionality of the component CGI Endpoint. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. The exploit has been released to the public a...
RHLW-2026-1CAAFB676CC0F4C9 Lightwell Security Advisory: netty-codec-http2 4.1.100.Final-rhlw-00001
Red Hat Lightwell has released io.netty:netty-codec-http2 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2025-55163, CVE-2026-33871, CVE-2026-42587, CVE-2026-47244, CVE-2026-48043, CVE-2026-50560, CVE-2026-56819, and CVE-2026-59900. CVE-2025-55163: Netty MadeYouReset HTTP/2 DDoS...
RHLW-2026-99869C1CAD4574FC Lightwell Security Advisory: netty-codec-http 4.1.100.Final-rhlw-00001
Red Hat Lightwell has released io.netty:netty-codec-http 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2024-29025, CVE-2025-58056, CVE-2025-67735, CVE-2026-33870, CVE-2026-41417, CVE-2026-42580, CVE-2026-42581, CVE-2026-42584, CVE-2026-42585, CVE-2026-42587, CVE-2026-50020, CVE-2026-5583...
CVE-2026-108909
A security flaw in Netcore NR268 1.7.121109 allows for cross-site request forgery (CSRF) via the CGI Endpoint component. An attacker can initiate this attack remotely by performing manipulation on the affected functionality. The exploit has been released to the public and may be used for attacks....
CVE-2026-108909 Netcore NR268 CGI Endpoint cross-site request forgery
A security flaw has been discovered in Netcore NR268 1.7.121109. Affected by this issue is some unknown functionality of the component CGI Endpoint. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. The exploit has been released to the public a...
EUVD-2026-97569
A security flaw has been discovered in Netcore NR268 1.7.121109. Affected by this issue is some unknown functionality of the component CGI Endpoint. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. The exploit has been released to the public a...
CVE-2026-108909 Netcore NR268 CGI Endpoint cross-site request forgery
A security flaw has been discovered in Netcore NR268 1.7.121109. Affected by this issue is some unknown functionality of the component CGI Endpoint. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. The exploit has been released to the public a...