Lucene search
+L

4576 matches found

Cvelist
Cvelist
added 2026/07/08 7:43 p.m.48 views

CVE-2026-58253 NATS Server: Route API Auth Bypass

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when noauthuser was configured, a parser fast path intended for ordinary client connections could also apply to route or leafnode listeners, allowing an...

8.8CVSS0.00368EPSS
SaveExploits0References7
ATTACKERKB
ATTACKERKB
added 2026/07/08 7:43 p.m.13 views

CVE-2026-58253

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when noauthuser was configured, a parser fast path intended for ordinary client connections could also apply to route or leafnode listeners, allowing an...

8.8CVSS6AI score0.00368EPSS
SaveExploits0References8Affected Software1
EUVD
EUVD
added 2026/07/08 7:43 p.m.22 views

EUVD-2026-42375

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when noauthuser was configured, a parser fast path intended for ordinary client connections could also apply to route or leafnode listeners, allowing an...

8.8CVSS6AI score0.00368EPSS
SaveExploits0References7
CVE
CVE
added 2026/07/08 7:43 p.m.66 views

CVE-2026-58253

NATS Server (affected: prior to 2.14.0, 2.12.7, and 2.11.16) contains a parser fast path vulnerability where no_auth_user handling could apply to route/leafnode listeners, enabling an unauthenticated peer to bypass inter‑server CONNECT authentication and operate with the privileges of that connec...

8.8CVSS6AI score0.00368EPSS
SaveExploits0References7Affected Software1
Vulnrichment
Vulnrichment
added 2026/07/08 7:43 p.m.10 views

CVE-2026-58253 NATS Server: Route API Auth Bypass

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when noauthuser was configured, a parser fast path intended for ordinary client connections could also apply to route or leafnode listeners, allowing an...

8.8CVSS6AI score0.00368EPSS
SaveExploits0References7
OSV
OSV
added 2026/07/08 7:43 p.m.12 views

CVE-2026-58253 NATS Server: Route API Auth Bypass

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when noauthuser was configured, a parser fast path intended for ordinary client connections could also apply to route or leafnode listeners, allowing an...

8.8CVSS6.1AI score
SaveExploits0References9
SUSE Linux
SUSE Linux
added 2026/07/08 7:31 p.m.12 views

Security update for dracut

This update for dracut fixes the following issue CVE-2026-6893: Root code execution via DHCP options command injection bsc1268322. Changes for dracut: Update to version 059+suse.565.g682306ec5: fixnetwork-legacy: sanitize DHCP values in dhclient-script.sh bsc1268322, CVE-2026-6893...

8.8CVSS6.4AI score0.01275EPSS
SaveExploits0References4
OSV
OSV
added 2026/07/08 7:31 p.m.19 views

SUSE-SU-2026:2803-1 Security update for dracut

This update for dracut fixes the following issue - CVE-2026-6893: Root code execution via DHCP options command injection bsc1268322. Changes for dracut: - Update to version 059+suse.565.g682306ec5: fixnetwork-legacy: sanitize DHCP values in dhclient-script.sh bsc1268322, CVE-2026-6893...

7.5CVSS6.4AI score0.01275EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2026/07/08 4:27 p.m.10 views

CVE-2026-59731

Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit, while later rewrite route matching performs an additional decodeURI operation and can resolve the request to a...

8.2CVSS6AI score0.00466EPSS
SaveExploits0References5Affected Software1
EUVD
EUVD
added 2026/07/08 1:48 p.m.20 views

EUVD-2026-42249

Capgo before 12.128.2 contains a broken access control vulnerability in the organization management API where a scoped API key limitedtoorgs inherits its owner-user's permissions, allowing destructive cross-organization actions. When a user is an admin in two organizations and creates a write-mod...

8.1CVSS6AI score0.00401EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/08 1:48 p.m.39 views

CVE-2026-56246

Capgo prior to 12.128.2 contains a broken access control in the organization management API. A scoped API key (limited_to_orgs) inherits its owner-user’s permissions, enabling cross‑organization destructive actions (e.g., DELETE /organization, DELETE /organization/members) when an admin belongs t...

8.1CVSS6AI score0.00401EPSS
SaveExploits0References2
FreeBSD
FreeBSD
added 2026/07/08 12:00 a.m.21 views

traefik -- Multiple vulnerabilities

The traefik project releases a new version addressing multiple vulnerabilities: GHSA-cxjq-mrr5-89rv Authentication Bypass via Path Traversal in ReplacePathRegex Middleware GHSA-42cj-m3vj-89wv CRD IngressRouteTCP ServersTransport Cross-Provider Namespace Bypass GHSA-qq9q-x9w4-chhj Gateway API...

5.3AI score
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/07/08 12:00 a.m.27 views

PT-2026-56516

Name of the Vulnerable Software and Affected Versions Astro version 6.4.7 Description Astro performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit. Subsequently, rewrite route matching performs an additional decodeURI operation, which can...

8.2CVSS6.1AI score0.00466EPSS
SaveExploits0References13
Positive Technologies
Positive Technologies
added 2026/07/08 12:00 a.m.23 views

PT-2026-56565

Name of the Vulnerable Software and Affected Versions NATS Server versions prior to 2.14.0 NATS Server versions prior to 2.12.7 NATS Server versions prior to 2.11.16 Description When no auth user is configured, a parser fast path designed for standard client connections may incorrectly apply to...

8.8CVSS6.1AI score0.00368EPSS
SaveExploits0References13
Positive Technologies
Positive Technologies
added 2026/07/08 12:00 a.m.30 views

PT-2026-56582

Name of the Vulnerable Software and Affected Versions NATS Server versions prior to 2.14.3 NATS Server versions prior to 2.12.12 Description A WebSocket listener may route requests for the MQTT-over-WebSocket path to MQTT handling processes even if MQTT is not configured. This allows an...

7.5CVSS6.1AI score0.006EPSS
SaveExploits0References10
OSV
OSV
added 2026/07/07 11:57 p.m.20 views

CVE-2026-55428 Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the tailnet coordinator validates that an agent's Addresses derive from its authenticated UUID but applies no equivalent check to AllowedIPs. The coordinato...

8.2CVSS6AI score
SaveExploits0References8
Cvelist
Cvelist
added 2026/07/07 11:57 p.m.50 views

CVE-2026-55428 Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the tailnet coordinator validates that an agent's Addresses derive from its authenticated UUID but applies no equivalent check to AllowedIPs. The coordinato...

8.2CVSS0.00405EPSS
SaveExploits0References6
CVE
CVE
added 2026/07/07 11:57 p.m.61 views

CVE-2026-55428

CVE-2026-55428 (Coder) describes a route hijack risk in the tailnet coordinator where an agent’s AllowedIPs are not validated against the agent’s authenticated UUID, unlike the Addresses check. The coordinator forwards adversarially supplied AllowedIPs to WireGuard peers, potentially enabling an ...

8.2CVSS6AI score0.00405EPSS
SaveExploits0References6Affected Software1
Vulnrichment
Vulnrichment
added 2026/07/07 11:57 p.m.13 views

CVE-2026-55428 Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the tailnet coordinator validates that an agent's Addresses derive from its authenticated UUID but applies no equivalent check to AllowedIPs. The coordinato...

8.2CVSS6AI score0.00405EPSS
SaveExploits0References6
OSV
OSV
added 2026/07/07 4:03 p.m.14 views

PYSEC-2026-1991 trytond does not enforce access rights for the route of the HTML editor.

Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70...

7.1CVSS5.9AI score0.00226EPSS
SaveExploits1References6
Rows per page
Query Builder