2099564 matches found
GHSA-C8W2-FGVX-VHV4 kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace
Summary The kcp front-proxy fails to strip client-supplied identity headers before forwarding requests to shards. Any authenticated tenant can inject their own X-Remote-Group and X-Remote-Extra- headers, which the shard trusts as a verified identity assertion — allowing a low-privilege user to...
CVE-2026-77385 Kyoo: Transcoder serves uncataloged files from the media directory
Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core.play permission could supply a base64-encoded filesystem path to the transcoder. The path handling in transcoder/src/api/path.go cleaned the value and checked only that it bega...
GHSA-QG67-7M6V-QG25 zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion
Summary A bearer token with only pull and push scopes can successfully delete manifests and blobs from a zot registry. The bearer authentication handler maps all non-GET/HEAD HTTP methods, including DELETE, to the "push" action, and the DistSpecAuthzHandler middleware is bypassed entirely for...
GHSA-F94Q-W3W8-CJ67 Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation
Summary A parameter order bug in internal/webhook/tenant/validation/hostnameregex.go causes the hostnameRegexHandler.OnUpdate webhook to validate the old Tenant object's AllowedHostnames.Regex instead of the new one being submitted. This allows an invalid malformed regex to bypass admission...
GHSA-GJW4-3V3V-RQXG Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement
Summary Capsule lets a cluster administrator forbid specific metadata keys that tenant owners must not place on their own resources: Tenant.spec.namespaceOptions.forbiddenLabels / forbiddenAnnotations namespaces, Tenant.spec.serviceOptions.forbiddenLabels / forbiddenAnnotations Services, and the...
GHSA-GXJC-74V5-3VX3 Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic
Summary A validation bug in internal/webhook/tenant/validation/forbiddenannotationsregex.go allows an invalid ForbiddenAnnotations.Regex value to bypass Tenant admission on update. The webhook compiles ForbiddenLabels.Regex for both labels and annotations, so a malformed annotations regex can be...
GHSA-39WR-7Q6H-CF68 LMDeploy has an SSRF bypass
Summary The URL checking logic in lmdeploy has a logical flaw that could be bypassed by attackers, leading to SSRF attacks. Details The current lmdeploy project uses issafeurl to validate the input URL. The main logic is to perform security checks on the host portion of the URL extracted by...
CVE-2026-33625 LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading
LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions 012.1 through 0.12.2 contain a code injection vulnerability in lmdeploy/pytorch/config.py line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model wit...
CVE-2026-62278 LubeLogger: Path Traversal in HandleTranslationFileUpload Allows Authenticated Users to Write Files Outside Data Directory
LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, authenticated non-administrative users could reach HandleTranslationFileUpload and influence the name passed from Controllers/FilesController.cs to RenameFile in Helper/FileHelper.cs...
MINI-GXG6-9MFG-488G
Bulletin has no description...
MINI-9PWJ-589H-2726
Bulletin has no description...
MINI-6H6F-QGM5-3FFW
Bulletin has no description...
MINI-RWJM-H4GH-XGQ3
Bulletin has no description...
MINI-F963-RCG3-V6XR
Bulletin has no description...
MINI-M5W4-CC6G-P8VC
Bulletin has no description...
MINI-622R-FJ46-5MVR
Bulletin has no description...
MINI-22W3-HFHH-9JJ7
Bulletin has no description...
MINI-7469-VG39-MQ53
Bulletin has no description...
CGA-48V6-7P2R-V2J5
Bulletin has no description...
CGA-WV4P-MV8P-MPWC
Bulletin has no description...
CGA-XPPX-WJ7W-32VJ
Bulletin has no description...
CVE-2026-62279 LubeLogger: IDOR in DuplicateRecordsToOtherVehicles Allows Copying Records from Any User's Vehicle Without Ownership Check
LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, an authenticated user could submit caller-controlled recordIds to the DuplicateRecordsToOtherVehicles endpoint while naming destination vehicleIds the user could edit. The endpoint...
MINI-3PHW-6C5M-3JPM
Bulletin has no description...
MINI-7M7C-RX34-VCW6
Bulletin has no description...
MINI-VW6C-85JH-X592
Bulletin has no description...
MINI-4VRP-F8M3-GGFM
Bulletin has no description...
MINI-HMWG-7FJJ-7WQX
Bulletin has no description...
MINI-7Q4P-4RXX-WR2W
Bulletin has no description...
MINI-6JMW-8PG8-9XX4
Bulletin has no description...
MINI-6H95-X7C5-6CCW
Bulletin has no description...
CVE-2026-84992 md-editor-v3: XSS via fenced-code language rendering bypass
md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt highlight callback in packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts inserts a fenced-code language value into class and language HTML attributes without escaping...
MINI-H6C5-PRW9-GR3R
Bulletin has no description...
MINI-QXH6-RVVQ-CQQQ
Bulletin has no description...
MINI-C2WC-7233-G838
Bulletin has no description...
MINI-56GH-9R48-85X3
Bulletin has no description...
MINI-2X7M-M9M7-V532
Bulletin has no description...
CVE-2026-84975 PJSIP: TLS server identity (hostname) verification bypass via embedded NUL in certificate SubjectAltName (OpenSSL and GnuTLS backends)
PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the OpenSSL and GnuTLS backends in pjlib/src/pj/sslsockossl.c and pjlib/src/pj/sslsockgtls.c copy DNS SubjectAltName values with string functions that recalculate their length and truncate an...
CGA-2W2C-GFM5-CJ9G
Bulletin has no description...
CGA-7WXC-QCQ7-C2M2
Bulletin has no description...
CGA-2VVC-MR23-VXH9
Bulletin has no description...
MINI-939M-GW6C-H2GV
Bulletin has no description...
MINI-G2MW-VG7R-5VP3
Bulletin has no description...
MINI-4543-R7P3-JV2W
Bulletin has no description...
CVE-2026-77396 PJSIP: Heap buffer overflow in the AVI parser
PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the PJSIP AVI parser in pjmedia/src/pjmedia/aviplayer.c uses an input-file video chunk length as the number of bytes copied into a frame buffer whose capacity is derived from the declared media...
MINI-2CR4-8V57-RW96
Bulletin has no description...
MINI-F9Q8-RXFQ-3PR5
Bulletin has no description...
MINI-XQR6-7F7V-8Q5F
Bulletin has no description...
MINI-HHCP-9VR6-7W35
Bulletin has no description...