Http4s Ember HTTP/2 does not enforce SETTINGS_MAX_CONCURRENT_STREAMS
CVE-2026-69203
An ember server with HTTP/2 enabled (`.withHttp2`) does not enforce `SETTINGS_MAX_CONCURRENT_STREAMS` on streams opened
#severity:high
共收录 5373 条相关情报。
← 返回所有主题Http4s Ember HTTP/2: unbounded inbound body buffering
CVE-2026-69202
Ember's HTTP/2 stack replenishes the inbound flow-control window based on bytes received off the wire, not bytes consume
ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange
CVE-2026-56668
### Summary A vulnerability in ZITADEL’s OAuth2 Token Exchange endpoint allows an authenticated user or client to excha
An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated...
CVE-2026-90460
An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 c
An example environment-configuration file ships with a fixed, publicly-known secret value used to...
CVE-2026-90451
An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication co
stb_vorbis through 1.22 contains a heap buffer overflow in start_decoder() where the codebook...
CVE-2026-89266
stb_vorbis through 1.22 contains a heap buffer overflow in start_decoder() where the codebook multiplicands allocation s
A deployment mode intended to expose only read access to stored data proxies a set of application...
CVE-2026-90448
A deployment mode intended to expose only read access to stored data proxies a set of application programming interface
A routing rule selects between two different authentication mechanisms for the same downstream...
CVE-2026-90447
A routing rule selects between two different authentication mechanisms for the same downstream service based on the valu
A file-transfer interface that requires valid credentials accepts attacker-controlled filenames...
CVE-2026-90444
A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shel
An interface that accepts file uploads from authenticated users extracts the contents of uploaded...
CVE-2026-90445
An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without valid
@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft
CVE-2026-59148
## Summary Mockoon's admin API ([`commons-server/src/libs/server/admin-api.ts`](https://github.com/mockoon/mockoon/blob
FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix
CVE-2026-59973
## Summary The published fix for GHSA-v6ph-xcq9-qxxj / CVE-2026-39885 added a direct hostname denylist for OpenAPI exte
Shopper: Missing authorization on product removal actions in CollectionProducts component
CVE-2026-56825
## Title Missing authorization on product removal actions in CollectionProducts component ## Description A lack of au
Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component
CVE-2026-56829
## Title Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component ## Descript
Shopper: privilege escalation via improper Livewire admin component authorization
CVE-2026-56828
## Summary Three Livewire admin components in `shopper/framework` (latest master at commit `fcd0c59`, released as v2.8.
Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers
CVE-2026-56827
## Summary Five Filament `groupedBulkActions` blocks across the Shopper admin Livewire pages omit the `->authorize(...)
Central Dogma: SSH host-key verification permanently disabled in Git mirror (SshGitMirror)
CVE-2026-11745
# Vulnerability Central Dogma's Git mirror SSH client installs an Apache MINA SSHD `ServerKeyVerifier` lambda that retu
Authentication bypass using an alternate path or channel and Improper validation of syntactic...
CVE-2026-88260
Authentication bypass using an alternate path or channel and Improper validation of syntactic correctness of input vulne
strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins...
CVE-2026-78134
strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins because there can be a
libcharon in strongSwan 6.0.0 through 6.0.7 has a use-after-free in IKEv2 rekeying collision...
CVE-2026-78133
libcharon in strongSwan 6.0.0 through 6.0.7 has a use-after-free in IKEv2 rekeying collision handling.