264143 matches found
GO-2026-5554 Ella Core has a UE Security Capability bypass on NGAP PathSwitchRequest in github.com/ellanetworks/core
Ella Core has a UE Security Capability bypass on NGAP PathSwitchRequest in github.com/ellanetworks/core...
GO-2026-5510 Gitea: Authorization Bypass via "Allow edits from maintainers" allows unauthorized commits to any readable repo in code.gitea.io/gitea
Gitea: Authorization Bypass via "Allow edits from maintainers" allows unauthorized commits to any readable repo in code.gitea.io/gitea...
GO-2026-5451 Juju: Read All Controller Logs From Compromised Workload in github.com/juju/juju
Juju: Read All Controller Logs From Compromised Workload in github.com/juju/juju...
GO-2026-5473 Nuclei: Environment variable disclosure via Response-Derived DSL Expressions in github.com/projectdiscovery/nuclei
Nuclei: Environment variable disclosure via Response-Derived DSL Expressions in github.com/projectdiscovery/nuclei...
GO-2026-5406 Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected in github.com/projectcapsule/capsule
Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected in github.com/projectcapsule/capsule...
GO-2026-5470 free5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence Subscriptions in github.com/free5gc/udr
free5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence Subscriptions in github.com/free5gc/udr...
CVE-2026-40080
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Open Redirect through a substring check rather than a host check at strcontains$referer, CACTIPATHURL. When the user's loginopts == '1' redirect to referer after login, the function use...
golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped...
CVE-2026-11800
creationtimestamp| type| source ---|---|--- 2026-06-25 22:17:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp5hhhr7qa2r 2026-06-29 13:15:15+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mpgkzuo7ml25 2026-07-01 02:46:32+00:00| seen|...
DEBIAN-CVE-2026-6092
When HAVEENCRYPTTHENMAC is configured, the implementation could fall back to MAC-then-Encrypt rather than enforcing Encrypt-then-MAC...
DEBIAN-CVE-2026-22879
A heap-based buffer overflow vulnerability exists in the vtkDICOMItem::FindDataElementOrInsert functionality of vtk-dicom versions: 9.5.2. A specially crafted DICOM file can lead to heap-based memory corruption. An attacker can provide a malicious file to trigger this vulnerability...
CVE-2026-6450
creationtimestamp| type| source ---|---|--- 2026-06-25 22:03:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp5golcu3b2a...
CVE-2025-71335
Flowise prior to version 3.0.10 is affected. Versions 3.0.7 and earlier do not invalidate existing sessions or session tokens after a user changes their password, allowing an attacker with an active session (e.g., via a stolen token or an already-logged-in device) to remain authenticated post-pas...
CVE-2025-71328
CVE-2025-71328 affects Flowise before 3.0.10. An authenticated user can change their account password via the Account Settings > Security page without providing the current password or any additional verification, because the application does not enforce a current-password check on credential ...
Access Control Bypass
Overview Affected versions of this package are vulnerable to Access Control Bypass in the GetInstance process. An attacker can access or modify resources belonging to other users by sending requests with their own credentials after another user has initialized the singleton, causing all subsequen...
EUVD-2026-38383
MessagePack-CSharp: DynamicUnionResolver-generated deserializers miss depth enforcement...
CVE-2026-6731
X.509 name constraint bypass via the Subject Common Name when treated as a DNS-type name. A certificate whose Subject CN violates an issuing CA's DNS name constraints could be accepted...
CVE-2017-14883
creationtimestamp| type| source ---|---|--- 2026-06-25 21:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mp5djxwqji2a...
