34011 matches found
EUVD-2026-29792
Relay adds real-time collaboration to Obsidian. Relay Server versions 0.9.0 through 0.9.6 contain an authentication bypass in the multi-document WebSocket endpoints. When authentication is configured, WebSocket connections without a token query parameter were incorrectly treated as having full...
CVE-2026-42889
Relay adds real-time collaboration to Obsidian. Relay Server versions 0.9.0 through 0.9.6 contain an authentication bypass in the multi-document WebSocket endpoints. When authentication is configured, WebSocket connections without a token query parameter were incorrectly treated as having full...
EUVD-2026-29544
Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions to obtain OTP secret keys and recovery codes via crafted requests to PAM API endpoints. This issue affects the following versions : Devolutions Server...
Apache Tomcat - AJP secret compared in non-constant time
Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 Apache Tomcat 9.0.0.M1 to 9.0.117 Older, unsupported versions may also be affected Description: The AJP secret was compared in non-constant time allowing an attacker on the local network to mount a timing...
harmonai-tools (0.0.5), neuralprophet (>=0.5.0rc1, <=0.5.1) +1 more potentially affected by CVE-2026-31221 via pytorch-lightning (1.7.4)
pytorch-lightning PYPI version 1.7.4 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - harmonai-tools 0.0.5 - neuralprophet =0.5.0rc1, =1.0.2, =1.0.4 Source cves: CVE-2026-31221 Source advisory:...
Malicious code in @a91082900/test_package (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8349cd7ce2c9ac2321dce8f80e5a46c0064b382fb7e54e975ff27a2dcab1254 The package's main file index.js executes at module load, with no exports and no user-invoked API. On import it issues...
CVE-2026-44196
Pingvin Share X (self-hosted file sharing) from versions 1.14.1–1.16.2 contains a critical authentication bypass that allows an attacker with valid credentials to skip the second-factor (TOTP) requirement. The attacker still needs the user’s password to reach this stage. The issue is fixed in 1.1...
CVE-2026-8407
Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions to obtain OTP secret keys and recovery codes via crafted requests to PAM API endpoints. This issue affects the following versions : Devolutions Server...
CVE-2026-8407
Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions to obtain OTP secret keys and recovery codes via crafted requests to PAM API endpoints. This issue affects the following versions : Devolutions Server...
GHSA-X3R2-FJ3R-G5MV
creationtimestamp| type| source ---|---|--- 2026-05-12 16:10:29+00:00| seen| https://gist.github.com/alon710/001644e5a9eb201b408c3975d7ef4c5c...
CVE-2026-32177
creationtimestamp| type| source ---|---|--- 2026-05-12 15:53:17+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0143 2026-05-12 16:38:43+00:00| seen| https://www.thezdi.com/blog/2026/5/12/the-may-2026-security-update-review 2026-05-13 01:08:48+00:00| seen|...
CVE-2026-8390
creationtimestamp| type| source ---|---|--- 2026-05-12 15:50:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlo5cthkad2p 2026-05-13 06:28:15+00:00| seen| https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-per-mozilla-firefox 2026-05-13 06:44:38+00:00| seen|...
CVE-2026-43514
Apache Tomcat is vulnerable to an Observable Timing Discrepancy when comparing AJP secrets . This flaw allows a remote attacker to potentially gain unauthorized access to protected information by exploiting timing mismatches during the secret comparison process. Affected versions include 11.0.0-M...
EUVD-2026-29470
Attacker can upload a malicious Sieve script over ManageSieve service or locally to bypass configured CPU time limits for Sieve up to 130 times of the configured limit. Attacker can use this to degrade server performance and bypass configured CPU time limits for Sieve scripts. Install fixed...
EUVD-2026-29462
Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3...
CVE-2026-30906
creationtimestamp| type| source ---|---|--- 2026-05-12 15:29:07+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3mlo44im56523 2026-05-31 21:41:53+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3mn6jt5dlyk2u...
CLSA-2026-1778599539 Fix CVE(s): CVE-2026-4878
SECURITY UPDATE: TOCTOU race condition in capsetfile - debian/patches/CVE-2026-4878.patch: open the target file and operate on /proc/self/fd/N so the inode is locked between the regular-file check and the xattr update - CVE-2026-4878...
Insufficiently Protected Credentials
Overview sealed-env is an Encrypted .env files with optional TOTP unsealing for production deploys. Cross-stack with the Java port. One minimal CLI dependency. Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the process of embedding the TOTP secret in t...
Important: Red Hat Security Advisory: kernel-rt security update
An update for kernel-rt is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...