Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
Assessment
Vulnerability Intelligence
Exploits
Alerts
Datasets
MCP
White Label
Security Automation SDK
MCP for AI Agents
Plans & Pricing
API Reference
Settings
Sign in
🔥 Daily Hot!
💪🏽 CPE Enhanced Advisories
🕶 Shadow Exploits
🕵🏼 Vulners CPE
🔐 Security news
💻 Exploit updates
📑 Blogs review
🐧 Linux vulnerabilities
🐞 Bugbounty
🤖 AI High Score
📰 CVE Feed
show all

70 matches found

Wolfi
Wolfi•added 2026/08/14 8:24 a.m.•46 views

GO-2026-5208 vulnerabilities

Vulnerabilities for packages: temporal-ui-server, temporal, snyk-cli, kube-metrics-adapter, fq...

5.8AI score
SaveExploits0
osv-cleanstart
osv-cleanstart•added 2026/08/13 12:10 p.m.•15 views

CLEANSTART-2026-UG13000 Security fixes in temporal-ui-server-fips 2.51.1-r1

Package temporal-ui-server-fips version 2.51.1-r1 fixes 36 vulnerabilities: CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832...

10CVSS6.6AI score0.00781EPSS
SaveExploits1References1
NVD
NVD•added 2026/08/11 8:18 p.m.•28 views

CVE-2026-65655

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

2.3CVSS0.00373EPSS
SaveExploits0References8
EUVD
EUVD•added 2026/08/11 7:29 p.m.•22 views

EUVD-2026-56924

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

2.3CVSS5.7AI score0.00373EPSS
SaveExploits0References8
attackerkb
attackerkb•added 2026/08/11 7:29 p.m.•21 views

CVE-2026-65655

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

2.3CVSS5.7AI score0.00373EPSS
SaveExploits0References9Affected Software1
osv-cve
osv-cve•added 2026/08/11 7:29 p.m.•32 views

CVE-2026-65655 Temporal UI Server may set OAuth credential cookies without Secure behind a TLS-terminating reverse proxy

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

2.3CVSS5.8AI score
SaveExploits0References12
Vulnrichment
Vulnrichment•added 2026/08/11 7:29 p.m.•14 views

CVE-2026-65655 Temporal UI Server may set OAuth credential cookies without Secure behind a TLS-terminating reverse proxy

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

2.3CVSS5.7AI score0.00373EPSS
SaveExploits0References8
CVE
CVE•added 2026/08/11 7:29 p.m.•59 views

CVE-2026-65655

Temporal UI Server may set OAuth credential cookies without Secure when TLS terminates at a reverse proxy and forwards callbacks to the UI server over HTTP. This can allow an attacker-controlled scenario to access access-token and possibly refresh-token cookies if the attacker can steer UI hostna...

2.3CVSS5.7AI score0.00373EPSS
SaveExploits0References8
Cvelist
Cvelist•added 2026/08/11 7:29 p.m.•49 views

CVE-2026-65655 Temporal UI Server may set OAuth credential cookies without Secure behind a TLS-terminating reverse proxy

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

2.3CVSS0.00373EPSS
SaveExploits0References8
Cvelist
Cvelist•added 2026/08/11 3:56 p.m.•51 views

CVE-2026-67179 Genkit improper host header validation

Genkit does not properly validate host request headers. Any host on the developer's network, and any website the developer visits via DNS rebinding, can reach POST /api/runAction on the Dev UI server default port 4000 and execute any registered Genkit action and read the result. Fixed on 2026-06-...

7.8CVSS0.00186EPSS
SaveExploits0References4
CVE
CVE•added 2026/08/11 3:56 p.m.•53 views

CVE-2026-67179

Genkit’s Dev UI server (default port 4000) suffers from improper validation of host request headers, enabling DNS rebinding to reach POST /api/runAction from any host on the developer’s network or any site the developer visits. This allows an attacker to execute any registered Genkit action and r...

7.8CVSS6AI score0.00186EPSS
SaveExploits0References4
ICS
ICS•added 2026/08/11 2:40 p.m.•21 views

Genkit improper host header validation

RISK EVALUATION Genkit does not properly validate host request headers. Any host on the developer's network, and any website the developer visits via DNS rebinding, can reach POST /api/runAction on the Dev UI server default port 4000 and execute any registered Genkit action and read the result...

7.8CVSS6AI score0.00186EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies•added 2026/08/11 12:00 a.m.•29 views

PT-2026-70889

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

2.3CVSS5.7AI score0.00373EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies•added 2026/08/11 12:00 a.m.•19 views

PT-2026-70265

Genkit does not properly validate host request headers. Any host on the developer's network, and any website the developer visits via DNS rebinding, can reach POST /api/runAction on the Dev UI server default port 4000 and execute any registered Genkit action and read the result. Fixed on 2026-06-...

7.8CVSS6AI score0.00186EPSS
SaveExploits0References5
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)•added 2026/08/11 12:00 a.m.•15 views

CVE-2026-65655: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

2.3CVSS5.7AI score0.00373EPSS
SaveExploits0References2
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)•added 2026/08/11 12:00 a.m.•9 views

CVE-2026-67179: Improper Neutralization of HTTP Headers for Scripting Syntax

Genkit does not properly validate host request headers. Any host on the developer's network, and any website the developer visits via DNS rebinding, can reach POST /api/runAction on the Dev UI server default port 4000 and execute any registered Genkit action and read the result. Fixed on 2026-06-...

7.8CVSS6AI score0.00186EPSS
SaveExploits0References2
osv-cleanstart
osv-cleanstart•added 2026/07/30 7:10 a.m.•13 views

CLEANSTART-2026-BQ82502 Security fixes in temporal-ui-server-fips 2.44.0-r0

Package temporal-ui-server-fips version 2.44.0-r0 fixes 2 vulnerabilities: CVE-2025-68121, CVE-2025-61732...

10CVSS7.4AI score0.00915EPSS
SaveExploits1References1
osv-cve
osv-cve•added 2026/07/14 7:28 p.m.•51 views

CVE-2026-47429 Vitest: Arbitrary file can be read and executed when Vitest UI server is listening

Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /vitestattachment, allowing \?\..\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile...

9.8CVSS6.2AI score
SaveExploits0References9
Cvelist
Cvelist•added 2026/07/14 7:28 p.m.•82 views

CVE-2026-47429 Vitest: Arbitrary file can be read and executed when Vitest UI server is listening

Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /vitestattachment, allowing \?\..\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile...

9.8CVSS0.00876EPSS
SaveExploits1References7
Vulnrichment
Vulnrichment•added 2026/07/14 7:28 p.m.•9 views

CVE-2026-47429 Vitest: Arbitrary file can be read and executed when Vitest UI server is listening

Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /vitestattachment, allowing \?\..\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile...

9.8CVSS6.1AI score0.00876EPSS
SaveExploits1References7
Rows per page
Query Builder