OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)
CVE-2026-73840
## Summary The OpenChoreo autobuild webhook endpoint (`POST /api/v1alpha1/autobuild`) selected the git provider used to
#cwe-290
共收录 318 条相关情报。
← 返回所有主题Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential...
CVE-2026-19117
Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and
Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as that user. This issue affects on-pr...
CVE-2026-19117
Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and
Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled ...
CVE-2026-14199
Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than z
Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated ...
CVE-2026-14199
Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than z
WWBN AVideo (current e01e41ecc and earlier) makes three login-time security controls depend...
CVE-2026-84479
WWBN AVideo (current e01e41ecc and earlier) makes three login-time security controls depend solely on the client-supplie
WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For...
CVE-2026-84476
WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers
WWBN AVideo (current e01e41ecc and earlier) makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder()/isAVideoMobile...
CVE-2026-84479
WWBN AVideo (current e01e41ecc and earlier) makes three login-time security controls depend solely on the client-supplie
WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers to spoof the client address used by enforceRateLimit(). ...
CVE-2026-84476
WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers
WWBN AVideo Authentication Bypass via User-Agent Header
CVE-2026-84479
WWBN AVideo (current e01e41ecc and earlier) makes three login-time security controls depend solely on the client-supplie
WWBN AVideo Authentication Bypass via X-Real-IP Header
CVE-2026-84476
WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers
A vulnerability in an API endpoint of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to spoof the source address attributed to their req...
CVE-2026-73742
A vulnerability in an API endpoint of HPE Networking Fabric Composer could allow an authenticated low privilege operator
Dell PowerStore contains an Authentication Bypass by Spoofing vulnerability. An authenticated attacker could potentially exploit this vulnerability to escalate privileges to Adm...
CVE-2026-58575
Dell PowerStore contains an Authentication Bypass by Spoofing vulnerability. An authenticated attacker could potentially
Unauthenticated Bypass Vulnerability in SiteGround Security <= 1.6.6 versions.
CVE-2026-82228
Unauthenticated Bypass Vulnerability in SiteGround Security <= 1.6.6 versions.
Unauthenticated Bypass Vulnerability in SiteGround Security <= 1.6.6 versions.
CVE-2026-82228
Unauthenticated Bypass Vulnerability in SiteGround Security <= 1.6.6 versions.
Zephyr's WireGuard implementation in subsys/net/lib/wireguard/wg_crypto.c mishandled keepalive packets. In wg_process_data_message(), any type-4 transport-data message whose pay...
CVE-2026-13735
Zephyr's WireGuard implementation in subsys/net/lib/wireguard/wg_crypto.c mishandled keepalive packets. In wg_process_da
phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSI_ALLOWED access-control check in read_config.php trusts attacker-controlled X-Fo...
CVE-2026-55584
phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSI_ALLOWED access-control
Authentication Bypass by Spoofing vulnerability in WPDeveloper Essential Addons for Elementor allows Identity Spoofing. This issue affects Essential Addons for Elementor: from ...
CVE-2026-81777
Authentication Bypass by Spoofing vulnerability in WPDeveloper Essential Addons for Elementor allows Identity Spoofing.
In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order for this to happen, the application mu...
CVE-2026-47845
In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is
AshAuthentication vulnerable to OAuth2/OIDC account takeover via email-based user matching
CVE-2026-49757
### Summary AshAuthentication's OAuth2 and OIDC family strategies matched the local user by email address rather than b