9 matches found
CLEANSTART-2026-NF97709 Security fixes in k8s-sidecar 2.5.4-r0
Package k8s-sidecar version 2.5.4-r0 fixes 2 vulnerabilities: CVE-2026-25645, ghsa-gc5v-m9x4-r6x2...
CVE-2026-41498
Kimai is an open-source time tracking application. Prior to version 2.54.0, the Team API endpoints use IsGranted'editteam' instead of IsGranted'edit', 'team', causing Symfony TeamVoter to abstain from voting. This removes entity-level ownership checks on team operations, allowing any user with th...
Insertion of Sensitive Information into Log File
Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the audit logging process. An attacker can obtain sensitive authentication information by accessing the audit device. This is only exploitable if an attacker has compromised access to...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization via the sys/revoke and sys/renew endpoints. An attacker can revoke or renew leases and underlying credentials belonging to other tenants by exploiting these endpoints if they have access to leaked lease...
CVE-2025-46655
CodiMD through 2.5.4 has a CSP-based protection mechanism against XSS through uploaded SVG documents containing JavaScript, but it can be bypassed in certain cases of different-origin file storage, such as AWS S3. NOTE: it can be considered a user error if AWS is employed for hosting untrusted...
CVE-2025-25823
A cross-site scripting XSS vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the article header at /admin/article.php...
CVE-2025-25827
A Server-Side Request Forgery SSRF in the component sort.php of Emlog Pro v2.5.4 allows attackers to scan local and internal ports via supplying a crafted URL...