CVE-2026-55775 OpenBao's System Backend allows Unauthorized Management of the containing Namespace

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao users granted capabilities on /sys/namespaces/root within a non-root namespace could exploit special handling of the literal root path in namespace canonicalization. The /sys/namespaces/ endpoint family ca...

CVE-2026-55775 OpenBao's System Backend allows Unauthorized Management of the containing Namespace

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao users granted capabilities on /sys/namespaces/root within a non-root namespace could exploit special handling of the literal root path in namespace canonicalization. The /sys/namespaces/ endpoint family ca...

CVE-2026-55775 OpenBao's System Backend allows Unauthorized Management of the containing Namespace

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao users granted capabilities on /sys/namespaces/root within a non-root namespace could exploit special handling of the literal root path in namespace canonicalization. The /sys/namespaces/ endpoint family ca...

GO-2026-5517 OpenBao's System Backend allows Unauthorized Management of the containing Namespace in github.com/openbao/openbao

OpenBao's System Backend allows Unauthorized Management of the containing Namespace in github.com/openbao/openbao...

GHSA-MWR2-WMGP-CRJ6 OpenBao's System Backend allows Unauthorized Management of the containing Namespace

Summary A user that is granted namespace management /sys/namespaces capabilities within a non-root namespace "the victim namespace" can abuse special handling of the literal path "root" in namespace path canonicalization to manage the victim namespace itself. Details Several endpoints under...

EUVD-2026-13796

Calling gethostbyaddr or gethostbyaddrr with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the...

CVE-2026-33054

Mesop is a Python-based UI framework that allows users to build web applications. Versions 1.2.2 and below contain a Path Traversal vulnerability that allows any user supplying an untrusted statetoken through the UI stream payload to arbitrarily target files on the disk under the standard...

Security update for glibc

This update for glibc fixes the following issues: CVE-2026-0915: resolv: Fix NSS DNS backend for getnetbyaddr bsc1256822, BZ 33802 CVE-2025-15281: posix: Reset wordexpt fields with WRDEREUSE bsc1257005, BZ 33814 CVE-2025-8058: posix: Fix double-free after allocation failure in regcomp bsc1246965,...

CVE-2024-38970

vaeThink 1.0.2 is vulnerable to Information Disclosure via the system backend,access management administrator function...

CVE-2024-48176

Lylme Spage v1.9.5 is vulnerable to Incorrect Access Control because it lacks a limit on the number of login attempts and fails to refresh the verification code after a failed login. This allows attackers to perform username and password blasting attacks to gain unauthorized access to the system ...

CVE-2024-48176

Lylme Spage v1.9.5 is vulnerable to Incorrect Access Control. There is no limit on the number of login attempts, and the verification code will not be refreshed after a failed login, which allows attackers to blast the username and password and log into the system backend...

CVE-2024-48176

Lylme Spage v1.9.5 is vulnerable to Incorrect Access Control. There is no limit on the number of login attempts, and the verification code will not be refreshed after a failed login, which allows attackers to blast the username and password and log into the system backend...

CVE-2024-48176

Lylme Spage v1.9.5 is vulnerable to Incorrect Access Control. There is no limit on the number of login attempts, and the verification code will not be refreshed after a failed login, which allows attackers to blast the username and password and log into the system backend...

CVE-2024-38970

vaeThink 1.0.2 is vulnerable to Information Disclosure via the system backend,access management administrator function...

CVE-2024-38971

vaeThink 1.0.2 is vulnerable to stored Cross Site Scripting XSS in the system backend...

CVE-2024-38970

vaeThink 1.0.2 is vulnerable to Information Disclosure via the system backend,access management administrator function...

CVE-2024-38971

CVE-2024-38971 affects vaeThink 1.0.2 and is a stored XSS vulnerability in the system backend. Multiple sources (Red Hat, NVD, OSV, CNNVD, CVE lists) confirm the issue; exploitation details are not provided in the documents. Some connected sources (PT-Security) advise temporarily disabling the ba...

CVE-2024-38970

vaeThink 1.0.2 is vulnerable to Information Disclosure via the system backend,access management administrator function...

CVE-2024-38970

vaeThink 1.0.2 is vulnerable to Information Disclosure via the system backend,access management administrator function...

CVE-2024-38970

The CVE-2024-38970 entries describe a vulnerability in vaeThink 1.0.2 where information disclosure can occur through the system backend, specifically via the access management administrator function. Available sources consistently identify the affected software (vaeThink 1.0.2) and the impact as ...