@hulumi/drift before 1.3.2 Unsafe Execute Plan Acceptance
CVE-2026-82858
@hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient provenance validation, a
#cwe-345
共收录 416 条相关情报。
← 返回所有主题A vulnerability was identified in Linux Foundation Magma 1.9.0. This affects an unknown function...
CVE-2026-82549
A vulnerability was identified in Linux Foundation Magma 1.9.0. This affects an unknown function of the component Securi
A vulnerability was identified in Linux Foundation Magma 1.9.0. This affects an unknown function of the component SecurityModeComplete Handler. Such manipulation leads to improp...
CVE-2026-82549
A vulnerability was identified in Linux Foundation Magma 1.9.0. This affects an unknown function of the component Securi
Linux Foundation Magma SecurityModeComplete integrity check
CVE-2026-82549
A vulnerability was identified in Linux Foundation Magma 1.9.0. This affects an unknown function of the component Securi
pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without...
CVE-2026-82462
pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without authorization code or ID token vali
pac4j-saml before 6.5.6 does not require signature validation of SAML LogoutRequest messages in...
CVE-2026-82465
pac4j-saml before 6.5.6 does not require signature validation of SAML LogoutRequest messages in SAML2LogoutValidator.val
pac4j-saml before 6.5.6 does not require signature validation of SAML LogoutRequest messages in SAML2LogoutValidator.validateLogoutRequest(). When an IdP sends no SessionIndex, ...
CVE-2026-82465
pac4j-saml before 6.5.6 does not require signature validation of SAML LogoutRequest messages in SAML2LogoutValidator.val
pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without authorization code or ID token validation. Attackers can substitute access tokens minted for...
CVE-2026-82462
pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without authorization code or ID token vali
pac4j-saml before 6.5.6 Session Destruction via Unsigned LogoutRequest
CVE-2026-82465
pac4j-saml before 6.5.6 does not require signature validation of SAML LogoutRequest messages in SAML2LogoutValidator.val
pac4j-oidc before 6.5.6 Authentication Bypass via Access Token Substitution
CVE-2026-82462
pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without authorization code or ID token vali
IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry parameter...
CVE-2026-82017
IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry parameter injection vulnerability that
IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry parameter injection vulnerability that allows attackers with physical access to execute arbitrar...
CVE-2026-82017
IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry parameter injection vulnerability that
Crossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature check
## Summary Crossplane allows package signature verification to be configured via the `ImageConfig` mechanism. When enab
openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed contact entries in...
CVE-2026-81706
openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore,
openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity st...
CVE-2026-81702
openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, al
openssl_encrypt before 1.4.9 Key Substitution via Identity Shadowing
CVE-2026-81706
openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore,
openssl_encrypt before 1.4.9 Key Substitution via Identity Load
CVE-2026-81702
openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, al
mediasoup is a WebRTC video conferencing system. From version 3.20.0 until 3.20.6 for the npm package and from 0.22.0 until 0.22.5 for the Rust crate, mediasoup's built-in SCTP ...
CVE-2026-55663
mediasoup is a WebRTC video conferencing system. From version 3.20.0 until 3.20.6 for the npm package and from 0.22.0 un
mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)
CVE-2026-55663
### Summary mediasoup's built-in SCTP stack (introduced in v3.20.0) authenticates SCTP state cookies using only hardcod
An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 (and later unreleased branches) on deployments using HTTP...
CVE-2026-53561
An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0