264140 matches found
Apache Kerby Kerberos Pre-authentication Bypass Vulnerability
Apache Kerby is a Java implementation of the Kerberos protocol, primarily used for providing authentication and authorization services. Apache Kerby has a vulnerability related to bypassing Kerberos pre-authentication. This vulnerability arises when users send PA-DATA that includes unrecognized o...
EUVD-2026-39484
pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes...
EUVD-2026-38067
Subsonic API: any authenticated user can delete or read any other user's playlist IDOR...
CVE-2026-52780
creationtimestamp| type| source ---|---|--- 2026-06-26 23:31:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpa42cxqt52c 2026-06-28 19:01:10+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mpenvjmkmg2v...
CVE-2026-52783
creationtimestamp| type| source ---|---|--- 2026-06-26 23:27:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpa3tm22wn2s 2026-06-28 20:00:39+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mper7ufns52x 2026-06-29 14:45:10+00:00| seen|...
EUVD-2026-39483
pnpm: Repository-controlled configDependencies can select a pacquet native install engine...
NPM: pnpm: Repository config can expand victim environment secrets into registry requests before scripts run
NPM: pnpm: Repository config can expand victim environment secrets into registry requests before scripts run vulnerability discovered by ? in WordPress Npm pnpm versions 10.34.2...
ImageMagick has a Heap Buffer Over-Write in SF3 encoder when writing multi-frame image
An crafted multi-frame can result in a heap buffer over-write when encoding it with the SF3 encoder...
GHSA-9RC6-8CJV-RCVX Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection
Description The getRedirectURL function in oauth2.go:22-29 constructs the OAuth2 callback URL by concatenating the request's Host header with a fixed path, with zero validation of the Host header: go func getRedirectURLc gin.Context string scheme := "http://" referer := c.Request.Referer if...
pnpm Vulnerable to Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)
Summary pnpm's patch application pipeline @pnpm/patch-package performs no path validation on file paths extracted from .patch files. An attacker who contributes a malicious patch file via a pull request can write attacker-controlled content to or delete arbitrary files on the filesystem during pn...
GHSA-RXHJ-4M44-96R4 pnpm Vulnerable to Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)
Summary pnpm's patch application pipeline @pnpm/patch-package performs no path validation on file paths extracted from .patch files. An attacker who contributes a malicious patch file via a pull request can write attacker-controlled content to or delete arbitrary files on the filesystem during pn...
CVE-2026-33560 Daktronics Controller Firmware Unrestricted Upload of File with Dangerous Type
The DMP-5000 file service exposes authenticated arbitrary file upload functionality. There are exposed endpoints which allows authenticated users to upload files of any type without validation. No file extension filtering or content inspection is enforced which allows executable binaries and...
CVE-2026-47075
creationtimestamp| type| source ---|---|--- 2026-06-26 22:35:05+00:00| published-proof-of-concept| https://github.com/benoitc/hackney/security/advisories/GHSA-j9wq-vxxc-94wf...
Hackney has CR/LF injection in query parameter
Summary hackneyurl:makeurl/3 passes the URL query component directly into the HTTP/1.1 request target without percent-encoding \r or \n. RFC 3986 §3.4 requires characters outside the query grammar to be percent-encoded, but no validation or escaping occurs. An attacker who controls any portion of...
EUVD-2026-39497
pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile...
GHSA-Q683-8468-R6H6 WebauthnAuthenticator leaks sensitive HTTP headers through INFO-level logs
Impact Webauthn\Bundle\Security\Http\Authenticator\WebauthnAuthenticator logs the full Symfony\Component\HttpFoundation\Request object inside the log context of both onAuthenticationSuccess and onAuthenticationFailure at INFO level: php $this-logger-info'User has been authenticated successfully...
GHSA-WPVJ-HJCR-H3P2 CakePHP: View::element() is missing a path containment check
Impact View::getElementFileName does not check that the resolved element path is within the application/plugin view template paths. When element names are created with specifically crafted user-supplied data this weakness can be leveraged to include other PHP files on the server. Patches Patched...
CakePHP: View::element() is missing a path containment check
Impact View::getElementFileName does not check that the resolved element path is within the application/plugin view template paths. When element names are created with specifically crafted user-supplied data this weakness can be leveraged to include other PHP files on the server. Patches Patched...
CVE-2026-49984 Kestra: Path traversal in `LocalStorage` allows any authenticated user to read arbitrary server files via the execution file-download API (`\..\` bypasses the `..` guard)
Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.23, the local internal-storage backend validates user-supplied paths for .. traversal before it converts Windows-style backslashes to forward slashes. An attacker can therefore smuggle a traversal sequence past...
CVE-2026-54351 Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override
Budibase is an open-source low-code platform. Prior to 3.39.9, the webhook trigger endpoint in Budibase is publicly accessible and passes the full HTTP request body into automation execution parameters. A mass assignment vulnerability in externalTrigger allows an attacker to overwrite the interna...