3449 matches found
CVE-2026-53961 Discourse: Forged AWS SNS bounce notifications can disable a targeted user's email (missing TopicArn binding)
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the AWS SES bounce webhook at POST /webhooks/aws verified that SNS messages were signed by Amazon but did not bind them to trusted TopicArn values, allowing any AWS account holder to publish...
GHSA-MG7H-Q7HW-M596 vulnerabilities
Vulnerabilities for packages: linux-aws...
CVE-2026-35552
In CAXperts UPVWebServices 2.4.2212.603 through 2.7.6 and UDiTH Portal 2026.0.0 through 2026.2.0, an authenticated remote user can invoke an administrative API endpoint intended for privileged users. Due to missing authorization checks, this allows the attacker to deactivate the application's...
CVE-2026-54783
CoreWCF (Net Core port of WCF) has an XML Signature Wrapping vulnerability in WS-Security endorsing/signature verification prior to v1.8.1 and v1.9.1, where the ds:Signature may not cover the expected Security header target. An attacker who captures a signed SOAP envelope can replay arbitrary ser...
CVE-2026-54773
CoreWCF WS-Security signature substitution vulnerability: prior to versions 1.8.1 and 1.9.1, WS-Security verification performs a document-wide ds:Signature lookup, allowing an unauthenticated remote attacker to place a SOAP header before wsse:Security and cause attacker-supplied ds:Signature to b...
CVE-2026-54773 CoreWCF: WS-Security signature substitution via document-wide Signature lookup
CoreWCF is a port of the service side of Windows Communication Foundation WCF to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF WS-Security signature verification performs a document-wide ds:Signature lookup, allowing an unauthenticated remote attacker to place a SOAP header before wsse:Security an...
CVE-2026-58501
Zeep is a Python SOAP client. From 4.0.0 before 4.3.3, Settings.forbidexternal is defined but not enforced when parsing WSDL or XSD documents, allowing transitive xsd:import, xsd:include, wsdl:import, and lxml entity or DTD references to fetch attacker-chosen HTTP or HTTPS URLs. This issue is fix...
CVE-2026-59897
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.3.3 before 4.12.27, the AWS API Gateway v1 adapter can drop a distinct repeated request header value because it de-duplicates values using a substring comparison instead of an exact match, so middleware o...
GHSA-F3Q5-7M6P-4QXQ vulnerabilities
Vulnerabilities for packages: linux-gcp, linux-vmware, linux-qemu, linux-azure, linux-qemu-melange, linux-aws...
GHSA-4PQW-3H25-QRQ3 vulnerabilities
Vulnerabilities for packages: linux-gcp, linux-vmware, linux-qemu, linux-azure, linux-qemu-melange, linux-aws...
GHSA-38RG-2RJC-3RMJ vulnerabilities
Vulnerabilities for packages: linux-gcp, linux-vmware, linux-qemu, linux-azure, linux-qemu-melange, linux-aws...
GHSA-3J78-PF43-6MVQ vulnerabilities
Vulnerabilities for packages: linux-gcp, linux-vmware, linux-qemu, linux-azure, linux-qemu-melange, linux-aws...
CVE-2026-53212 vulnerabilities
Vulnerabilities for packages: linux-gcp, linux-vmware, linux-qemu, linux-azure, linux-qemu-melange, linux-aws...
CVE-2026-53228 vulnerabilities
Vulnerabilities for packages: linux-gcp, linux-vmware, linux-qemu, linux-azure, linux-qemu-melange, linux-aws...
GHSA-5Q2P-7748-G6QP vulnerabilities
Vulnerabilities for packages: linux-gcp, linux-vmware, linux-qemu, linux-azure, linux-qemu-melange, linux-aws...
GHSA-6GQ6-HXJH-9GRQ vulnerabilities
Vulnerabilities for packages: linux-gcp, linux-vmware, linux-qemu, linux-azure, linux-qemu-melange, linux-aws...
CVE-2026-53149 vulnerabilities
Vulnerabilities for packages: linux-gcp, linux-vmware, linux-qemu, linux-azure, linux-qemu-melange, linux-aws...
GHSA-HFRJ-R4V7-3997 vulnerabilities
Vulnerabilities for packages: linux-gcp, linux-vmware, linux-qemu, linux-azure, linux-qemu-melange, linux-aws...