60 matches found
PT-2026-94418
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The st33zp24 status function fails to verify the result of the transport read operation. In scenarios where the I2C transport skips i2c master recv due to a short or failed register-sele...
CVE-2026-15054
The Bit Form WordPress plugin (versions before 3.1.2 ) contains a vulnerability where public form-submission handlers fail to verify if a form is currently active or published. This oversight allows unauthenticated users to submit entries to deactivated or unpublished forms, which can trigger con...
CVE-2026-45417 DataEase: SQL injection vulnerability
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase datasource connection status checks concatenate configuration.getSchema into getTablesSql and execute the resulting SQL with executeQuery in io.dataease.datasource.provider.CalciteProvidercheckStatus,...
EUVD-2026-44776
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase datasource connection status checks concatenate configuration.getSchema into getTablesSql and execute the resulting SQL with executeQuery in io.dataease.datasource.provider.CalciteProvidercheckStatus,...
Authentication Bypass
Spring Web Services is vulnerable to Authentication Bypass. The vulnerability is due to X509AuthenticationProvider issuing a fully authenticated X509AuthenticationToken based solely on certificate-to-user mapping, without enforcing standard account status checks such as disabled, locked, expired,...
OpenSSL Improper Exception Handling Vulnerability
OpenSSL is an open-source encryption library developed by the OpenSSL team that enables secure implementation of Secure Sockets Layer SSLv2/v3 and Secure Transport Layer TLSv1 protocols. This product supports various encryption algorithms, including symmetric ciphers, hash algorithms, and secure...
CVE-2026-44185
The Apache HTTP Server versions 2.4.0 through 2.4.67 are vulnerable to a Buffer Over-read vulnerability. The issue occurs when the server processes outbound OCSP requests directed toward an attacker-controlled OCSP server. Exploitation of this flaw could allow a malicious actor to cause service i...
openSUSE 16 Security Update : tomcat (openSUSE-SU-2026:20611-1)
The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20611-1 advisory. - CVE-2026-24880: Request smuggling via invalid chunk extension bsc1261850. - CVE-2026-25854: Occasionally open redirect bsc1261851. -...
PT-2026-34781
OpenClaw before 2026.3.31 contains a session visibility bypass vulnerability where the session status function fails to enforce configured tools.sessions.visibility restrictions for unsandboxed invocations. Attackers can invoke session status without sandbox constraints to bypass session-policy...
openSUSE 16 Security Update : tomcat11 (openSUSE-SU-2026:20595-1)
The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20595-1 advisory. - Update to Tomcat 11.0.21 - CVE-2026-24880: Request smuggling via invalid chunk extension bsc1261850. - CVE-2026-25854: Occasionally open...
Improper Authentication
Overview org.apache.tomcat:tomcat-coyote is a Tomcat Connectors and HTTP parser. Affected versions of this package are vulnerable to Improper Authentication in processOCSPRequest, which is part of the the CLIENTCERT authentication process. An attacker can trigger a soft-fail of OCSP checks when...
CrewAI security vulnerabilities
CrewAI is an open-source code execution and analysis tool component developed by CrewAI. CrewAI has a security vulnerability that stems from incorrect checking of Docker’s running status and reverting to a sandbox setting, which may lead to remote code execution...
Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect
Summary When a user account is disabled or locked, the status check is only enforced on the local login and JWT token refresh paths. Three other authentication paths — API tokens, CalDAV basic auth, and OpenID Connect — do not verify user status, allowing disabled or locked users to continue...
Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect
When a user account is disabled or locked, the status check is only enforced on the local login and JWT token refresh paths. Three other authentication paths — API tokens, CalDAV basic auth, and OpenID Connect — do not verify user status, allowing disabled or locked users to continue accessing th...
Fixed in Apache Tomcat 10.1.53
Moderate: The fix forCVE-2025-66614 was incomplete CVE-2026-32990 The validation of SNI name and host name did not take account of possible differences in case allowing the strict SNI checks to be bypassed. This was fixed with commit 4d0615a5. This issue was reported to the Tomcat security team o...
Fixed in Apache Tomcat 11.0.20
Moderate: The fix forCVE-2025-66614 was incomplete CVE-2026-32990 The validation of SNI name and host name did not take account of possible differences in case allowing the strict SNI checks to be bypassed. This was fixed with commit 021d1f83. This issue was reported to the Tomcat security team o...
Linux kernel RAID10 Sync Request DoS
The vulnerability of the raid10syncrequest function in the drivers/md/raid10.c module of the Linux kernel’s device driver for multiple devices RAID and LVM is related to display errors when reporting resource status due to inconsistent checks. Exploiting this vulnerability can allow an attacker t...
Linux kernel Mellanox mlx5 DoS
The vulnerability of the drivers/net/ethernet/mellanox/mlx5 kernel component of the Linux operating system is related to insufficient checking of the status of shared resources. Exploiting this vulnerability can allow an attacker to cause service failures...
PT-2026-20960
Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.14 Description The skills.status function could reveal sensitive information to clients with operator.read access. This occurred because the function returned raw resolved config values within configChecks for...