Lucene search
+L

4571 matches found

OSV
OSV
added 2026/07/08 7:43 p.m.12 views

CVE-2026-58253 NATS Server: Route API Auth Bypass

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when noauthuser was configured, a parser fast path intended for ordinary client connections could also apply to route or leafnode listeners, allowing an...

8.8CVSS6.1AI score
SaveExploits0References9
SUSE Linux
SUSE Linux
added 2026/07/08 7:31 p.m.12 views

Security update for dracut

This update for dracut fixes the following issue CVE-2026-6893: Root code execution via DHCP options command injection bsc1268322. Changes for dracut: Update to version 059+suse.565.g682306ec5: fixnetwork-legacy: sanitize DHCP values in dhclient-script.sh bsc1268322, CVE-2026-6893...

8.8CVSS6.4AI score0.01275EPSS
SaveExploits0References4
OSV
OSV
added 2026/07/08 7:31 p.m.19 views

SUSE-SU-2026:2803-1 Security update for dracut

This update for dracut fixes the following issue - CVE-2026-6893: Root code execution via DHCP options command injection bsc1268322. Changes for dracut: - Update to version 059+suse.565.g682306ec5: fixnetwork-legacy: sanitize DHCP values in dhclient-script.sh bsc1268322, CVE-2026-6893...

7.5CVSS6.4AI score0.01275EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2026/07/08 4:27 p.m.10 views

CVE-2026-59731

Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit, while later rewrite route matching performs an additional decodeURI operation and can resolve the request to a...

8.2CVSS6AI score0.00466EPSS
SaveExploits0References5Affected Software1
EUVD
EUVD
added 2026/07/08 1:48 p.m.20 views

EUVD-2026-42249

Capgo before 12.128.2 contains a broken access control vulnerability in the organization management API where a scoped API key limitedtoorgs inherits its owner-user's permissions, allowing destructive cross-organization actions. When a user is an admin in two organizations and creates a write-mod...

8.1CVSS6AI score0.00401EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/08 1:48 p.m.39 views

CVE-2026-56246

Capgo prior to 12.128.2 contains a broken access control in the organization management API. A scoped API key (limited_to_orgs) inherits its owner-user’s permissions, enabling cross‑organization destructive actions (e.g., DELETE /organization, DELETE /organization/members) when an admin belongs t...

8.1CVSS6AI score0.00401EPSS
SaveExploits0References2
FreeBSD
FreeBSD
added 2026/07/08 12:00 a.m.21 views

traefik -- Multiple vulnerabilities

The traefik project releases a new version addressing multiple vulnerabilities: GHSA-cxjq-mrr5-89rv Authentication Bypass via Path Traversal in ReplacePathRegex Middleware GHSA-42cj-m3vj-89wv CRD IngressRouteTCP ServersTransport Cross-Provider Namespace Bypass GHSA-qq9q-x9w4-chhj Gateway API...

5.3AI score
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/07/08 12:00 a.m.27 views

PT-2026-56516

Name of the Vulnerable Software and Affected Versions Astro version 6.4.7 Description Astro performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit. Subsequently, rewrite route matching performs an additional decodeURI operation, which can...

8.2CVSS6.1AI score0.00466EPSS
SaveExploits0References13
Positive Technologies
Positive Technologies
added 2026/07/08 12:00 a.m.23 views

PT-2026-56565

Name of the Vulnerable Software and Affected Versions NATS Server versions prior to 2.14.0 NATS Server versions prior to 2.12.7 NATS Server versions prior to 2.11.16 Description When no auth user is configured, a parser fast path designed for standard client connections may incorrectly apply to...

8.8CVSS6.1AI score0.00368EPSS
SaveExploits0References13
Positive Technologies
Positive Technologies
added 2026/07/08 12:00 a.m.30 views

PT-2026-56582

Name of the Vulnerable Software and Affected Versions NATS Server versions prior to 2.14.3 NATS Server versions prior to 2.12.12 Description A WebSocket listener may route requests for the MQTT-over-WebSocket path to MQTT handling processes even if MQTT is not configured. This allows an...

7.5CVSS6.1AI score0.006EPSS
SaveExploits0References10
OSV
OSV
added 2026/07/07 11:57 p.m.20 views

CVE-2026-55428 Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the tailnet coordinator validates that an agent's Addresses derive from its authenticated UUID but applies no equivalent check to AllowedIPs. The coordinato...

8.2CVSS6AI score
SaveExploits0References8
Cvelist
Cvelist
added 2026/07/07 11:57 p.m.50 views

CVE-2026-55428 Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the tailnet coordinator validates that an agent's Addresses derive from its authenticated UUID but applies no equivalent check to AllowedIPs. The coordinato...

8.2CVSS0.00405EPSS
SaveExploits0References6
CVE
CVE
added 2026/07/07 11:57 p.m.61 views

CVE-2026-55428

CVE-2026-55428 (Coder) describes a route hijack risk in the tailnet coordinator where an agent’s AllowedIPs are not validated against the agent’s authenticated UUID, unlike the Addresses check. The coordinator forwards adversarially supplied AllowedIPs to WireGuard peers, potentially enabling an ...

8.2CVSS6AI score0.00405EPSS
SaveExploits0References6Affected Software1
Vulnrichment
Vulnrichment
added 2026/07/07 11:57 p.m.11 views

CVE-2026-55428 Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the tailnet coordinator validates that an agent's Addresses derive from its authenticated UUID but applies no equivalent check to AllowedIPs. The coordinato...

8.2CVSS6AI score0.00405EPSS
SaveExploits0References6
OSV
OSV
added 2026/07/07 4:03 p.m.14 views

PYSEC-2026-1991 trytond does not enforce access rights for the route of the HTML editor.

Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70...

7.1CVSS5.9AI score0.00226EPSS
SaveExploits1References6
OSV
OSV
added 2026/07/07 3:26 p.m.16 views

GO-2026-5915 Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder...

8.2CVSS5.9AI score0.00405EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/07 11:45 a.m.17 views

PYSEC-2026-1704 NiceGUI allows potential access to local file system

NiceGUI is an easy-to-use, Python-based UI framework. A local file inclusion is present in the NiceUI leaflet component when requesting resource files under the /nicegui/version/resources/key/path:path route. As a result any file on the backend filesystem which the web server has access to can be...

8.2CVSS7AI score0.0076EPSS
SaveExploits0References7
OSV
OSV
added 2026/07/07 11:45 a.m.15 views

PYSEC-2026-2027 Voilà Local file inclusion

Impact Any deployment of voilà dashboard allow local file inclusion, that is to say any file on a filesystem that is readable by the user that runs the voilà dashboard server can be downloaded by someone with network access to the server. Whether this still requires authentication depends on how...

7.5CVSS6.9AI score0.00725EPSS
SaveExploits0References10
OSV
OSV
added 2026/07/07 11:45 a.m.15 views

PYSEC-2026-1820 pyload Unauthenticated Flask Configuration Leakage vulnerability

Summary Any unauthenticated user can browse to a specific URL to expose the Flask config, including the SECRETKEY variable. Details Any unauthenticated user can browse to a specific URL to expose the Flask config, including the SECRETKEY variable. PoC Run pyload in the default configuration by...

7.5CVSS7.2AI score0.42443EPSS
SaveExploits1References6
NVD
NVD
added 2026/07/06 9:16 p.m.23 views

CVE-2026-54765

Traefik is an open source HTTP reverse proxy and load balancer. From v3.7.0 prior to v3.7.6, Traefik's Kubernetes Gateway API provider may resolve two accepted HTTPRoutes that target the same backend Service:port but configure different backendRef filters to the same child service and apply only...

8.5CVSS0.00276EPSS
SaveExploits0References4
Rows per page
Query Builder