CVE-2026-61801

The github.com/moby/sys/user package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing /etc/passwd- or /etc/group-style files, allowing an attacker who can supply a specially...

CVE-2026-61801

The "github.com/moby/sys/user" package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing "/etc/passwd"- or "/etc/group"-style files, allowing an attacker who can supply a...

EUVD-2026-95094

The github.com/moby/sys/user package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing /etc/passwd- or /etc/group-style files, allowing an attacker who can supply a specially...

CVE-2026-61801 github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

The github.com/moby/sys/user package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing /etc/passwd- or /etc/group-style files, allowing an attacker who can supply a specially...

CVE-2026-61801

The github.com/moby/sys/user Go package, versions before 0.4.1 , is vulnerable to a Denial of Service (DoS) because it does not sufficiently limit entries when parsing /etc/passwd or /etc/group -style files. An attacker capable of supplying a specially crafted file can trigger excessive memory co...

CVE-2026-61801 github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

The github.com/moby/sys/user package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing /etc/passwd- or /etc/group-style files, allowing an attacker who can supply a specially...

CVE-2026-61801 github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

The github.com/moby/sys/user package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing /etc/passwd- or /etc/group-style files, allowing an attacker who can supply a specially...

GHSA-MJCV-P78Q-W5FW github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

A denial-of-service DoS vulnerability exists in github.com/moby/sys/user before v0.4.1 when parsing specially crafted user or group database files. An attacker able to supply a malicious /etc/passwd or /etc/group-style file may cause excessive memory consumption, potentially resulting in process...

github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

A denial-of-service DoS vulnerability exists in github.com/moby/sys/user before v0.4.1 when parsing specially crafted user or group database files. An attacker able to supply a malicious /etc/passwd or /etc/group-style file may cause excessive memory consumption, potentially resulting in process...

sssd: sssd: IdP authentication prefix comparison allows cross-user impersonation

A flaw was found in SSSD's IdP authentication provider. The evalaccesstokenbuf function compares the OIDC subject identifier using strncmp with the authenticated user's identifier length, performing a prefix comparison instead of an exact match. An attacker whose IdP identifier is a strict prefix...

Moderate: Red Hat Security Advisory: sssd security update

An update for sssd is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

CVE-2026-107640

Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows unauthenticated attackers to change account passwords by omitting the reset parameter. Attackers can target accounts with no pending reset, whose empty resetkey match...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Sangoma Freepbx

freepbx-rce-detector Triage scanner for CVE-2025-57819, t...

EUVD-2026-95027

Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows unauthenticated attackers to change account passwords by omitting the reset parameter. Attackers can target accounts with no pending reset, whose empty resetkey match...

CVE-2026-107640 Integrics Enswitch 3.13 through 4.4 Authentication Bypass via Password Reset API

Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows unauthenticated attackers to change account passwords by omitting the reset parameter. Attackers can target accounts with no pending reset, whose empty resetkey match...

CVE-2026-107640

Integrics Enswitch versions 3.13 through 4.4 are vulnerable to an authentication bypass within the /api/json/user/password/update/ endpoint. The root cause is a weak password recovery mechanism where an unauthenticated attacker can change account passwords by omitting the reset parameter. By targ...

EUVD-2026-94976

Incorrect permission assignment in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to read or overwrite the inter-process communication handles used between the TightVNC service and its desktop server process. The named shared memory segment in the Global...

CVE-2026-105893

Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Manipulating User-Controlled Variables.This issue affects Event Tickets: from n/a through 5.30.0.1...

CVE-2026-106603

Authorization Bypass Through User-Controlled Key vulnerability in Groundhogg HollerBox holler-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HollerBox: from n/a through 2.3.14...

CVE-2026-105893

The Liquid Web / StellarWP Event Tickets plugin (version 5.30.0.1 and earlier) is vulnerable to an Authorization Bypass caused by a User-Controlled Key vulnerability. This flaw allows for the manipulation of User-Controlled Variables , potentially leading to unauthorized access. The CVSS 3.1 scor...