CVE-2019-16097

CVE-2019-16097 This program is only for security research, do not use it illegally! Vulnerability Impact Attackers can create an administrator account, upload malicious images, and infect clients using the repository. Affected Component Harbor Affected Versions 1.7.0-1.8.2 Remediation Upgrade to...

cargo-perm

Description A new vulnerability in cargo version 1.7.0 has been found as explained here. Step by Step First you have to make sure your cargo version is vulnerable cargo --version Supose I have a cargo project with the following src/main.rs file: root@kitploit: use numbigint::BigInt; use...

Astra Linux – Vulnerability in hunspell

Hunspell 1.7.0 has an invalid read operation in SuggestMgr::left CommonsSubstring in suggestmgr.cxx...

pwndoc v1.7.0

PwnDoc PwnDoc is a pentest reporting application making it simple and easy to write your findings and generate a customizable Docx report. The main goal is to have more time to Pwn and less time to Doc by mutualizing data like vulnerabilities between users. Documentation Installation Data Roles...

Node.js Module axios 1.7.0 < 1.18.0 maxBodyLength Bypass (CVE-2026-67317)

The version of the axios Node.js module installed on the remote host is 1.7.0 prior to 1.18.0. It is, therefore, affected by a vulnerability: - axios fails to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. Attackers ca...

CVE-2026-19022 OpenHands send_pull_request.py initialize_repo command injection

A vulnerability was determined in OpenHands up to 0.62.0. The affected element is the function initializerepo of the file OpenHands/resolver/sendpullrequest.py. This manipulation causes command injection. Remote exploitation of the attack is possible. The vendor deleted the original GitHub issue...

EUVD-2026-53834

A vulnerability was determined in OpenHands up to 0.62.0. The affected element is the function initializerepo of the file OpenHands/resolver/sendpullrequest.py. This manipulation causes command injection. Remote exploitation of the attack is possible. The vendor deleted the original GitHub issue...

CVE-2026-67332

Technical details (affected products/versions/mitigation) are not publicly provided in the supplied documents. Monitor for updates.

CVE-2026-67332 @better-auth/oauth-provider before 1.7.0-beta.4 Authorization Bypass

@better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience to the authorization grant, allowing clients to request tokens for unrelated resources. Attackers can complete an OAuth flow and obtain access tokens whose audience targets resource servers the authorization never...

CVE-2026-67327

Better-Auth before 1.6.22 is vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers a victims email with a chosen password; the account remains unverified. When the victim signs in later...

CLEANSTART-2026-YB97810 Security fixes in prometheus-node-exporter-fips 1.7.0-r1

Package prometheus-node-exporter-fips version 1.7.0-r1 fixes 2 vulnerabilities: CVE-2025-61727, CVE-2025-61729...

CLEANSTART-2026-XU98118 Security fixes in vault-csi-provider 1.7.0-r0

Package vault-csi-provider version 1.7.0-r0 fixes 20 vulnerabilities: CVE-2026-34986, CVE-2026-33186, CVE-2026-32280, CVE-2026-32281, CVE-2026-32283...

CLEANSTART-2026-YN06108 Security fixes in yunikorn-k8shim 1.7.0-r0

Package yunikorn-k8shim version 1.7.0-r0 fixes 5 vulnerabilities: ghsa-vvgc-356p-c3xw, CVE-2025-68121, CVE-2025-61732, CVE-2025-47911, CVE-2025-58190...

CLEANSTART-2026-DK44310 Security fixes in kubernetes-dashboard-web-fips 1.7.0-r0

Package kubernetes-dashboard-web-fips version 1.7.0-r0 fixes 2 vulnerabilities: ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x...

CLEANSTART-2026-SH73570 Security fixes in prometheus-node-exporter-fips 1.7.0-r0

Package prometheus-node-exporter-fips version 1.7.0-r0 fixes 2 vulnerabilities: ghsa-6v2p-p543-phr9, ghsa-8r3f-844c-mc37...

CLEANSTART-2026-FI63843 Security fixes in tekton-pipelines-fips 1.7.0-r0

Package tekton-pipelines-fips version 1.7.0-r0 fixes 14 vulnerabilities: ghsa-p77j-4mvh-x3m3, ghsa-p436-gjf2-799p, ghsa-78h2-9frx-2jm8, CVE-2025-15558, CVE-2026-34986...

CLEANSTART-2026-PV07726 Security fixes in yunikorn-web-fips 1.7.0-r0

Package yunikorn-web-fips version 1.7.0-r0 fixes 24 vulnerabilities: CVE-2026-39820, CVE-2026-25679, CVE-2026-27143, CVE-2025-68121, CVE-2026-42499...

CLEANSTART-2026-AK78194 Security fixes in yunikorn-k8shim-fips 1.7.0-r1

Package yunikorn-k8shim-fips version 1.7.0-r1 fixes 19 vulnerabilities: CVE-2026-27139, CVE-2026-39825, CVE-2026-32288, CVE-2026-27142, CVE-2026-32289...

CVE-2026-50248

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still considered as a possible XFR endpoint. A malicious actor that can spoof the hostname's A/AAAA record no valid RRSIG required becomes the zone'...

CVE-2026-44690

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to poison arbitrary...