2105193 matches found
CVE-2026-55563 Feast: `pull_request_target` integration tests run untrusted fork code with production cloud secrets; the `ok-to-test` label guard is bypassable via label persistence on `synchronize`
Feast is the open source feature store for AI and machine learning. Prior to 0.65.0, .github/workflows/printegrationtests.yml uses pullrequesttarget with the synchronize event and preserves ok-to-test, approved, or lgtm labels across newly pushed commits, allowing a fork contributor to obtain...
CVE-2026-88978 Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pkg/repository/durableevents.go passes caller-supplied durable task, node, and branch identifiers to ListSatisfiedEntries without a tenant...
CVE-2026-84298 Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.95.3, the V1 DurableTask stream handler stores worker-supplied taskexternalid values in the durableInvocations routing map before tenant ownership is verified, and callback delivery...
GHSA-PHG3-3G28-WQ9V Hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState
Summary Hatchet version v0.86.26 and below is vulnerable to OAuth state CSRF login CSRF / account fixation. The vulnerable code clears the session oauthstate value to the empty string "" after a successful OAuth callback rather than removing the key, and the subsequent state-equality check then...
CVE-2026-61687 hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauthstate session value to an empty string after a successful OAuth callback and later accepts an empty state parameter as equal, allowing an...
CVE-2026-63342 Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-runs/workflowrun.yaml defines the GET /api/v1/stable/durable-tasks/durable-task endpoint implemented by listDurableEventLog without requiri...
CVE-2026-61681 Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get on payload.UnsubscribeURL after VerifyPayload even though BuildSignature...
CVE-2026-85751 Mailu: Authentication bypass in header-based proxy authentication via spoofable `X-Forwarded-By` trust
Mailu is a mail server distributed as a set of Docker images. From Mailu 2.0 until 2024.06.55 and prior to Mailu helm-charts 2.7.3, deployments with PROXYAUTHWHITELIST configured but REALIPHEADER unset trusted a client-controlled X-Forwarded-By header for header-based proxy authentication. The...
CLSA-2026-1790005086 TuxCare security update for fast-xml-parser (1 CVE)
TuxCare rebuilt fast-xml-parser to address 1 CVE. Fixed in 4.5.1-tuxcare.3...
CVE-2026-53940 Conda: Entry-point path traversal in noarch:python install (arbitrary file write) — canonical Python implementation
Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parseentrypointdef in conda/common/path/python.py accepted an unvalidated entry-point command from a noarch:python package's info/link.json metadata...
CLSA-2026-1790004677 TuxCare security update for webpack-dev-server (3 CVEs)
TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 5.2.2-tuxcare.2...
CLSA-2026-1790004614 TuxCare security update for browserslist (1 CVE)
TuxCare rebuilt browserslist to address 1 CVE. Fixed in 4.14.2-tuxcare.2...
CLSA-2026-1790004555 TuxCare security update for systeminformation (1 CVE)
TuxCare rebuilt systeminformation to address 1 CVE. Fixed in 5.23.8-tuxcare.2...
DEBIAN-CVE-2026-94184
A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response...
UBUNTU-CVE-2026-94301
The fix for CVE-2026-47065/ZDRES-232 "resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy", released on 2026-06-02 and announced as "Fully addressed" in MINA 2.2.8, 2.1.13 and 2.0.29, was committed to the 2.2.X branch only. The 2.0.X and 2.1.X maintenance...
UBUNTU-CVE-2026-80110
A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both...
UBUNTU-CVE-2026-94184
A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response...
CGA-X534-W5M3-5HXM
Bulletin has no description...
CVE-2026-71543 OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters
OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, templated ACL, PKI, and SSH policies could substitute attacker-controlled identity data without rejecting syntax-significant characters. In ACL templated policies, asterisks, plus signs, and slashes could alter pa...
CVE-2026-52742 GoCD is vulnerable to historical server configuration API authorization bypass
GoCD is a continuous deliver server. From 12.3.1 until 26.1.0, legacy routes under /go/admin/restful/ expose historical full server configuration to pipeline group administrators instead of restricting responses to configuration for groups they administer. The disclosed configuration can include...
CVE-2026-55870 GoCD is vulnerable to credential exposure when admins insecurely configure material URLs
GoCD is a continuous deliver server. Prior to 26.1.0, GoCD can return unmasked credentials that administrators stored in the userinfo portion of source control material URLs through several read-only APIs available to regular authenticated users. Although GoCD recommends dedicated username and...
CVE-2026-55625 GoCD is vulnerable to authorization bypass via material connection test APIs
GoCD is a continuous deliver server. From 16.1.0 until 26.1.0, the internal material connection test APIs at /go/api/admin/internal/materialtest and /go/api/internal/configrepos//materialtest accept an arbitrary existing pipeline and pipeline-group context without sufficient validation. A pipelin...
CVE-2026-52740 GoCD is vulnerable to pipeline template view API authorization bypass
GoCD is a continuous deliver server. From 18.7.0 until 26.1.0, the Get Template Config API compares HTTP method names case-sensitively when selecting authorization filters. A lower-privileged authenticated user can send a request with nonstandard HTTP method capitalization to retrieve a pipeline...
CVE-2026-55060 GoCD is vulnerable to authorization bypass via support process list API
GoCD is a continuous deliver server. From 13.1.0 until 26.1.0, the /go/api/support/processlist endpoint does not enforce its intended administrator-only authorization. An authenticated internal user can query the endpoint while source control child processes are running and view command-line...
CVE-2026-52741 GoCD has stored XSS possible via tracking tool link highlighting on Compare Pipeline pages
GoCD is a continuous deliver server. From 18.3.0 until 26.1.0, GoCD can generate unescaped tracking-tool links from commit comments when a project uses a lenient Tracking Tool regular expression with an ID capturing group, such as JIRA-.+. An attacker with commit access to a tracked material can...
MINI-3QWJ-FG6V-3G63
Bulletin has no description...
MINI-PG45-9GX4-4CGM
Bulletin has no description...
MINI-4G3W-27MQ-6532
Bulletin has no description...
MINI-R68J-XFQ8-2QVR
Bulletin has no description...
MINI-9C95-67J3-9F27
Bulletin has no description...
MINI-7QH9-2QP3-J93M
Bulletin has no description...
MINI-4GQ7-RVXG-J82V
Bulletin has no description...
MINI-M5R3-2RHF-GRGX
Bulletin has no description...
MINI-5WRX-F57J-GCGC
Bulletin has no description...
MINI-VV9W-5C66-7F95
Bulletin has no description...
MINI-7WFJ-CJ2C-HMMQ
Bulletin has no description...
MINI-3M3P-XQX3-M69P
Bulletin has no description...
MINI-H4X3-GWFX-PWQ5
Bulletin has no description...
MINI-VGQM-G79Q-72VG
Bulletin has no description...
MINI-JJXJ-XC6Q-W2W9
Bulletin has no description...
CVE-2026-68919 GoCD has stored XSS possible via forged package material comments on Stage/Job/VSM pages
GoCD is a continuous deliver server. From 13.3.0 until 26.1.0, GoCD does not correctly encode and escape malicious material modification comments that mimic the special trackback format used by package materials when rendering the Stage Detail, Job/Build Detail, Value Stream Map, and Pipeline...
MINI-545P-89JC-MFFC
Bulletin has no description...
MINI-XFR3-97PH-G4G3
Bulletin has no description...
MINI-F8XX-4QCJ-G4Q7
Bulletin has no description...
MINI-PG7P-MW4V-QG8F
Bulletin has no description...
CLSA-2026-1790002371 TuxCare security update for org.springframework.data (1 CVE)
TuxCare rebuilt 3 org.springframework.data packages to address 1 CVE. Fixed in 4.1.8-tuxcare.1...
CLSA-2026-1790002143 TuxCare security update for org.springframework.data (2 CVEs)
TuxCare rebuilt 3 org.springframework.data packages to address 2 CVEs. Fixed in 4.4.13-tuxcare.3...
CLSA-2026-1790002044 TuxCare security update for org.springframework.data (4 CVEs)
TuxCare rebuilt 5 org.springframework.data packages to address 4 CVEs. Fixed in 4.1.8-tuxcare.1...
CVE-2026-61628 nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition
nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, POST /api/users/onboarding/finish is registered as anonymous unauthenticated and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act TOCTOU pattern between the...