172515 matches found
CVE-2026-119572
Traefik from 3.7.0-ea.1 before 3.7.15 contains an authentication bypass vulnerability in the Kubernetes Ingress NGINX provider that silently disables mTLS configured via the auth-tls-secret annotation. When another Ingress declares a path on the same host without matching auth-tls settings, Traef...
CVE-2026-119571
Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an authorization flaw that applies Installation updates addressed by object ID to the installation named in the X-Parse-Installation-Id header. When protectedFieldsTriggerExempt is enabled, attackers knowing another installation's object ID...
CVE-2026-119570
Parse Server from 9.7.0 before 9.10.5-alpha.7 contains an information disclosure vulnerability that allows clients to receive protected field values written by beforeSave triggers using dot notation keys. When protectedFieldsSaveResponseExempt is set to false, clients with create or update...
CVE-2026-119569
Parse Server before 8.6.108 and 9.0.0 before 9.10.5-alpha.9 contains a prototype pollution vulnerability because user-controlled keys are expanded into objects without own-property checks. Clients with class write access can send dot notation field keys or ACL entry names matching built-in object...
CVE-2026-118986
CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand. The secret that signs session cookies is built from two calls to the built-in rand, which is seeded with 32 bits. The secret therefore has at most 232 possible values, and one signed...
CVE-2026-118987
CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header. cookieConf rejects a cookie older than 300 seconds only when it arrives in the xsc query parameter. The same cookie sent in the X-Session-Cookie header is accepted however old it is....
CVE-2026-118990
CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup. getConfigBlob has the sqlite3 shell write the dump to /tmp/cbdump and never removes it. The file takes the process umask, and a symlink planted at that...
CVE-2026-118991
CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key. getCrypt pads the backup password with "x" characters and cuts it to 32 bytes to form the AES key, with no salt and no key derivation. The first block of a backup holds a 16 hex digi...
CVE-2026-118992
CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup. restoreConfigBlob feeds the database dump in a backup to the sqlite3 command-line shell. The shell runs lines starting with a dot as its own commands, so .shell or...
CVE-2026-118993
CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI. The beforedispatch hook installed by startup removes PATHINFO from the end of the request URI with a substitution that interpolates PATHINFO...
CVE-2026-118994
CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name. login writes the login name to the application log without escaping control characters. The login RPC method needs no authentication, so a name containing a newline followed by text in the log record...
CVE-2026-118995
CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator. createRxValidator is documented to anchor the supplied pattern at both ends, but builds /^$rx$/ without grouping the pattern. An alternation such as yes|no then accepts any value...
CVE-2026-118996
CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig. getUserConfig returns the caller's whole cbuser row, including the stored password hash and the note field that the user interface shows only to administrators...
CVE-2026-13576
CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes. Passwords are hashed with hmacsha1sum from Mojo::Util with no key, a single fast SHA-1 HMAC. There is no salt, so equal passwords give equal hashes, and no work factor slows down guessing. An attacker w...
CVE-2026-119038
Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leaked redirect flow ID create payments against another customer's mandate. confirmresource takes no session token from the caller. It reads the redirect flow back from the...
CVE-2026-119037
Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty. signaturevalid uses each configured secret as the HMAC key, and nothing rejects undef or an empty string, both of which Digest::SHA treats as an empty key. A secret read...
CVE-2026-119036
Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signature. A webhook body with a top-level "payload" key is verified as a legacy webhook. To rebuild the signed string, the payload is flattened into one key and...
CVE-2026-116128
Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded buffering when decoding chunked request bodies. The decoder adds each read to one buffer of unconsumed input. Nothing limits the length of a chunk-size line, so a line without a CRLF grows the buffer for as long...
CVE-2026-116127
Starlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next response on a persistent or pipelined connection. The request method is not passed to the response writer, so whatever body the application returns for a HEAD request is sent. With...
CVE-2026-115866
Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies. A chunk-size line is matched as a run of hex digits, then . and a CRLF. A run followed by a bare LF and then a CRLF can never match, and the engine retrie...
CVE-2026-115865
Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory. The request body is read in a loop that asks sysread for all of the remaining declared length at once. Perl grows the read buffer to that size before any data arrives, so ...
CVE-2026-116130
HTTP::Parser::XS versions before 0.18 for Perl truncate PATHINFO at an encoded NUL byte in parsehttprequest. The XS parser URL-decodes the request path and measures the result with strlen, so PATHINFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote attacke...
CVE-2026-118988
CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc route. Every CallBackery application mounts its documentation plugin at /doc, ahead of any session check. The route passes the requested name to Pod::Simple::Search-find...
CVE-2026-87768
DateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via a per-day loop when adding seconds. normalizeleapseconds crosses day boundaries one day at a time, so addseconds = $n on an object with a non-floating time zone takes about |$n|/86400 iterations, and nothing limits $n. The XS...
MSC-2026-13225
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Malicious obfuscated code – the code is...
MSC-2026-13193
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...
MSC-2026-13190
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Malicious obfuscated code – the code is...
MSC-2026-13194
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Malicious obfuscated code – the code is...
MSC-2026-13214
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Malicious obfuscated code – the code is...
MSC-2026-13184
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Malicious obfuscated code – the code is...
MSC-2026-13207
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...
MSC-2026-13181
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...
MSC-2026-13208
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...
MSC-2026-13224
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...
MSC-2026-13188
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Malicious obfuscated code – the code is...
MSC-2026-13221
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Malicious obfuscated code – the code is...
MSC-2026-13217
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Malicious obfuscated code – the code is...
MSC-2026-13178
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...
MSC-2026-13211
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...
MSC-2026-13183
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Malicious obfuscated code – the code is...
MSC-2026-13185
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...
MSC-2026-13199
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...
MSC-2026-13222
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...
MSC-2026-13209
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...
MSC-2026-13179
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...
MSC-2026-13198
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...
MSC-2026-13200
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...
MSC-2026-13220
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Malicious obfuscated code – the code is...
MSC-2026-13218
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Malicious obfuscated code – the code is...
MSC-2026-13180
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...