2436 matches found
WeKan /metrics unconditionally trusts X-Forwarded-For, allowing whitelist IP spoofing (MetricsBleed)
WeKan /metrics Unconditionally Trusts X-Forwarded-For, Allowing Whitelist IP Spoofing MetricsBleed Vulnerability Overview WeKan's Prometheus /metrics endpoint restricts access via an IP whitelist only configured monitoring IPs are allowed. When determining the client's source IP, the code...
Seafile server-controlled sync path can escape the client worktree (macOS/Linux)
Seafile server-controlled sync path can escape the client worktree macOS/Linux Vulnerability Overview The Seafile client's sync module applies file diffs delivered by the server during the checkout phase, and the target path of rename operations is fully controlled by the server. The validity che...
WeKan expired impersonation records bypass private board export authorization (ImpersonateBleed)
WeKan Expired Impersonation Records Bypass Private Board Export Authorization ImpersonateBleed Vulnerability Overview WeKan administrators can use the impersonation feature to operate as other users, and the system records every impersonation action. The flaw is this: in addition to the normal...
Vaultwarden unconditionally trusts the X-Real-IP header, enabling rate-limit bypass and audit IP spoofing
Vaultwarden Unconditional Trust in the X-Real-IP Request Header Leading to Rate-Limit Bypass and Audit IP Spoofing Overview Vaultwarden supports reading the client IP from a configurable HTTP request header IPHEADER, default X-Real-IP for rate limiting of login/2FA and the admin panel, as well as...
GStreamer DTLS plugin openssl_verify_callback stack buffer overflow on certificate subject DN causes remote denial of service
GStreamer DTLS Plugin Stack Buffer Overflow in Certificate Subject DN Handling Causes Remote Denial of Service CVE-2026-59692 Vulnerability Overview In the GStreamer DTLS plugin the dtls element of gst-plugins-bad, used for the DTLS channel in WebRTC pipelines, the peer certificate verification...
[FreeBSD] thr_kill2 permission check bypass: cross-UID signal delivery
Summary thrkill2 does not check pcansignal return value before tdksignal, allowing cross-UID signal delivery by local unprivileged users. Fixed in commit bf1e2c07. CVE-2026-45256, FreeBSD-SA-26:25.thr...
Suricata: undisclosed vulnerability (ZAI-2026-ZGY90J)
Not disclosed. Details are not yet publicly disclosed...
FFmpeg: undisclosed vulnerability (ZAI-2026-42S9BI)
Not disclosed. Details are not yet publicly disclosed...
wget2: undisclosed vulnerability (ZAI-2026-EXL6WR)
Not disclosed. Details are not yet publicly disclosed...
lwIP: undisclosed vulnerability (ZAI-2026-O3JX0Y)
Not disclosed. Details are not yet publicly disclosed...
GStreamer: undisclosed vulnerability (ZAI-2026-C3517B)
Not disclosed. Details are not yet publicly disclosed...
FineReport: undisclosed vulnerability (ZAI-2026-LMZN40)
Not disclosed. Details are not yet publicly disclosed...
Stripe: undisclosed vulnerability (ZAI-2026-PDG48R)
Not disclosed. Details are not yet publicly disclosed...
WordPress: undisclosed vulnerability (ZAI-2026-F0YIO5)
Not disclosed. Details are not yet publicly disclosed...
Affirm: undisclosed vulnerability (ZAI-2026-VNVE7A)
Not disclosed. Details are not yet publicly disclosed...
Frappe Connected App OAuth flow: insufficient permission checks and external redirect
Frappe Connected App OAuth Flow: Insufficient Permission Checks and External Redirect Vulnerability Overview Connected App in Frappe Framework is an OAuth2 client integration mechanism; its whitelisted method is used to generate an authorization URL for a user and write the authorization state in...
DokuWiki Revert plugin renders changelog usernames unescaped, leading to stored XSS
DokuWiki Revert plugin renders changelog usernames unescaped, leading to stored XSS Vulnerability Overview DokuWiki's built-in revert admin plugin, when listing changelog edit records, HTML-escapes edit summaries but outputs the changelog user field verbatim. For authentication backends that do n...
Portainer Edge Agent endpoints do not validate EdgeStack assignment, allowing unauthorized reads of unassigned stack files and forged status reports
Portainer Edge Agent Endpoint EdgeStack Assignment Authorization Bypass Vulnerability Overview Two categories of Portainer Server endpoints serving Edge Agents -- Edge Stack deployment-file retrieval and deployment status reporting -- resolve the reporting environment from the Edge ID in the...
Linux kernel MRP: vector attribute parsing errors break applicant state handling
Linux kernel MRP: vector attribute parsing errors break applicant state handling Vulnerability Overview The Linux kernel MRP IEEE 802.1 Multiple Registration Protocol PDU parser mishandles zero-length vector attributes, event counts and attribute-value advancement in mrppduparsevecattr, breaking...
FTP parser: recoverable RETR error escalated to APP_LAYER_ERROR disables FTP application-layer inspection on the same flow
FTP parser: recoverable RETR error escalated to APPLAYERERROR disables FTP application-layer inspection on the same flow Vulnerability Overview Suricata's FTP application-layer parser escalates a protocol-recoverable command-ordering error — a client sending RETR/STOR before negotiating a data po...
WebKit single-bug RCE: crafted web content yields AAR/AAW/PC-hijack in content process
Summary A memory-corruption vulnerability in Apple's WebKit engine is reachable from maliciously crafted web content. Apple's public advisory understates the impact as an "unexpected process crash" and notes it was addressed with improved memory handling. In practice the bug is a single-shot remo...
Linux kernel garp: unsigned integer underflow in garp_pdu_parse_attr
In the Linux kernel, the following vulnerability has been resolved: net: garp: fix unsigned integer underflow in garppduparseattr The receive-side GARP attribute parser computes dlen with reversed operands: dlen = sizeofga - ga-len; ga-len is the on-wire attribute length and includes the GARP...
Suricata datasets: non-string value_key in JSON/NDJSON dataset enrichment causes null-pointer dereference denial of service
Suricata datasets: non-string valuekey in JSON/NDJSON dataset enrichment causes null-pointer dereference denial of service Vulnerability Overview Suricata supports loading external datasets in JSON/NDJSON format and using dataset records to enrich traffic e.g., enriching IP addresses, domains, an...
Nacos: undisclosed vulnerability (ZAI-2026-HAFEU3)
Not disclosed. Details are not yet publicly disclosed...
Knot Resolver: undisclosed vulnerability (ZAI-2026-HFI2PO)
Not disclosed. Details are not yet publicly disclosed...
wolfSSL: undisclosed vulnerability (ZAI-2026-95ZYA4)
Not disclosed. Details are not yet publicly disclosed...
OpenBSD: undisclosed vulnerability (ZAI-2026-IM0KO2)
Not disclosed. Details are not yet publicly disclosed...
Redis: undisclosed vulnerability (ZAI-2026-7FQ3CB)
Not disclosed. Details are not yet publicly disclosed...
MongoDB: undisclosed vulnerability (ZAI-2026-M5JLW3)
Not disclosed. Details are not yet publicly disclosed...
Nacos: undisclosed vulnerability (ZAI-2026-4COHSD)
Not disclosed. Details are not yet publicly disclosed...
Kubernetes: undisclosed vulnerability (ZAI-2026-BJK0C7)
Not disclosed. Details are not yet publicly disclosed...
WinRAR: undisclosed vulnerability (ZAI-2026-Y5KTQB)
Not disclosed. Details are not yet publicly disclosed...
Intel Integrated Performance Primitives: undisclosed vulnerability (ZAI-2026-DVOTYV)
Not disclosed. Details are not yet publicly disclosed...
Beyond Compare: undisclosed vulnerability (ZAI-2026-6I43U8)
Not disclosed. Details are not yet publicly disclosed...
FineReport: undisclosed vulnerability (ZAI-2026-WP2SMY)
Not disclosed. Details are not yet publicly disclosed...
Beyond Compare: undisclosed vulnerability (ZAI-2026-2FCVKK)
Not disclosed. Details are not yet publicly disclosed...
Superbet: undisclosed vulnerability (ZAI-2026-HERZB6)
Not disclosed. Details are not yet publicly disclosed...
WeKan Avatar Localization follows redirects, bypassing SSRF protections (RedirectBleed)
WeKan Avatar Localization Follows Redirects, Bypassing SSRF Protections RedirectBleed Vulnerability Overview WeKan allows users to set an external avatar URL in their profile, and the server-side avatar localization feature fetches that URL and caches the avatar as a local attachment. Although SS...
Joomla com_installer update list stored XSS (description/detailsurl unescaped)
Joomla cominstaller Update List Stored XSS CVE-2026-48952 Vulnerability Overview The extension update list in the Joomla CMS administrative backend the update view of cominstaller renders the description and detailsurl fields of extension update information without HTML escaping, constituting a...
GStreamer librfb: rfb_decoder_fill_rectangle() wrong write granularity causes heap out-of-bounds write
GStreamer librfb: rfbdecoderfillrectangle wrong write granularity causes heap out-of-bounds write Vulnerability Overview In rfbsrc the VNC/RFB client element of GStreamer gst-plugins-bad, rfbdecoderfillrectangle fills rectangles by writing pixels at guint32 4-byte granularity regardless of the...
Linux kernel 9p: oldfid erroneously released in p9_client_walk() error path
In the Linux kernel, the following vulnerability has been resolved: 9p: avoid putting oldfid in p9clientwalk error path When p9clientwalk is called with clone set to false, fid aliases oldfid. If the walk subsequently fails after the request has been sent, the error path jumps to clunkfid, which...
lwIP: undisclosed vulnerability (ZAI-2026-S05AIC)
Not disclosed. Details are not yet publicly disclosed...
Linux: undisclosed vulnerability (ZAI-2026-PRK61D)
Not disclosed. Details are not yet publicly disclosed...
GStreamer: undisclosed vulnerability (ZAI-2026-JTMJZE)
Not disclosed. Details are not yet publicly disclosed...
BIND9: undisclosed vulnerability (ZAI-2026-UFC8MD)
Not disclosed. Details are not yet publicly disclosed...
Outlook: undisclosed vulnerability (ZAI-2026-HLJV88)
Not disclosed. Details are not yet publicly disclosed...
Redis: undisclosed vulnerability (ZAI-2026-WLIMQP)
Not disclosed. Details are not yet publicly disclosed...
pdnsd: undisclosed vulnerability (ZAI-2026-BFR6N4)
Not disclosed. Details are not yet publicly disclosed...