π¨ CVE-2026-66144
Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the API it can cause a denial of service attack if a huge policy is retrieved. Users are recommended to upgrade to version 3.2.3, which fixes this issue by imposing a default maximum size on data read from remote policy references.
π@cveNotify
Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the API it can cause a denial of service attack if a huge policy is retrieved. Users are recommended to upgrade to version 3.2.3, which fixes this issue by imposing a default maximum size on data read from remote policy references.
π@cveNotify
π¨ CVE-2026-49326
Missing Authorization vulnerability in Apache HBase thrift and rest delegation service.
A scan operation in thrift/rest service has 3 steps, open, fetch(possible multiple times), close.
The open step will return an id which will be passed back to server for identifying the scanner instances stored at server side.
We missed the owner check in fetch and close steps which means a user can fetch rows from the scanner which is opened by other users, and close scanners which belongs to other users.
This issue affects Apache HBase:from 3.0.0-alpha-1 through 3.0.0-beta-1, from 2.6.0 through 2.6.5, from 2.5.0 through 2.5.14, through 2.4.*.
Users are recommended to upgrade to version 3.0.0-beta-2, 2.6.6 and 2.5.15, which fixes the issue.
π@cveNotify
Missing Authorization vulnerability in Apache HBase thrift and rest delegation service.
A scan operation in thrift/rest service has 3 steps, open, fetch(possible multiple times), close.
The open step will return an id which will be passed back to server for identifying the scanner instances stored at server side.
We missed the owner check in fetch and close steps which means a user can fetch rows from the scanner which is opened by other users, and close scanners which belongs to other users.
This issue affects Apache HBase:from 3.0.0-alpha-1 through 3.0.0-beta-1, from 2.6.0 through 2.6.5, from 2.5.0 through 2.5.14, through 2.4.*.
Users are recommended to upgrade to version 3.0.0-beta-2, 2.6.6 and 2.5.15, which fixes the issue.
π@cveNotify
π¨ CVE-2026-65709
sysPass through version 3.2.11 contains a missing object-level authorization vulnerability in the JSON-RPC API that allows API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without per-account access control. Attackers can invoke AccountController methods such as viewAction, editAction, deleteAction, and editPassAction without AccountFilterUser checks to modify or delete accounts beyond the scope of their assigned token permissions.
π@cveNotify
sysPass through version 3.2.11 contains a missing object-level authorization vulnerability in the JSON-RPC API that allows API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without per-account access control. Attackers can invoke AccountController methods such as viewAction, editAction, deleteAction, and editPassAction without AccountFilterUser checks to modify or delete accounts beyond the scope of their assigned token permissions.
π@cveNotify
GitHub
cve-advisories/2026/sysPass/CVE-2026-65709.md at main Β· Caycon/cve-advisories
Contribute to Caycon/cve-advisories development by creating an account on GitHub.
π¨ CVE-2026-17107
A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke ServiceAccount holds unrestricted impersonation permissions. An authenticated hub principal can inject an Impersonate-Group header to escalate to cluster-admin on every managed cluster.
π@cveNotify
A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke ServiceAccount holds unrestricted impersonation permissions. An authenticated hub principal can inject an Impersonate-Group header to escalate to cluster-admin on every managed cluster.
π@cveNotify
π¨ CVE-2026-48021
In epa4all, prior to version 2026-05-20, an attacker who can intercept the TLS connection between epa4all and the ePA backend can complete the VAU handshake with attacker-controlled keys and obtain the session encryption keys. All inner HTTP traffic (patient consent decisions, medication data, document operations, authorization tokens, and entitlement queries) becomes readable and modifiable. The attacker can also inject arbitrary requests through the hijacked channel. This issue has been patched in version 2026-05-20.
π@cveNotify
In epa4all, prior to version 2026-05-20, an attacker who can intercept the TLS connection between epa4all and the ePA backend can complete the VAU handshake with attacker-controlled keys and obtain the session encryption keys. All inner HTTP traffic (patient consent decisions, medication data, document operations, authorization tokens, and entitlement queries) becomes readable and modifiable. The attacker can also inject arbitrary requests through the hijacked channel. This issue has been patched in version 2026-05-20.
π@cveNotify
GitHub
Release 2026-05-20 Β· med-united/epa4all
Full Changelog: 2026-05-18...2026-05-20
π¨ CVE-2026-48032
Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, IAM-role policy checks can be bypassed when the role trusts multiple OIDC providers. This issue has been patched in version 1.4.0.
π@cveNotify
Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, IAM-role policy checks can be bypassed when the role trusts multiple OIDC providers. This issue has been patched in version 1.4.0.
π@cveNotify
GitHub
security: fix 4 HIGH + 15 MEDIUM Codex findings (8 root-cause clusters) β DCO-signed replacement for #177 by kerberosmansour Β·β¦
Replacement for #177 β identical changes, but every commit now carries a Signed-off-by (the cherry-picked worktree commits were missing DCO sign-off in #177). Opened as a fresh PR rather than force...
π¨ CVE-2026-48033
Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, policy packs can be bypassed by a forged Pulumi-URN logical name. This issue has been patched in version 1.4.0.
π@cveNotify
Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, policy packs can be bypassed by a forged Pulumi-URN logical name. This issue has been patched in version 1.4.0.
π@cveNotify
GitHub
security: fix 4 HIGH + 15 MEDIUM Codex findings (8 root-cause clusters) β DCO-signed replacement for #177 by kerberosmansour Β·β¦
Replacement for #177 β identical changes, but every commit now carries a Signed-off-by (the cherry-picked worktree commits were missing DCO sign-off in #177). Opened as a fresh PR rather than force...
π¨ CVE-2026-48034
Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, there is a bypass via decoy sibling resources targeting a different bucket. This issue has been patched in version 1.4.0.
π@cveNotify
Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, there is a bypass via decoy sibling resources targeting a different bucket. This issue has been patched in version 1.4.0.
π@cveNotify
GitHub
fix(policies): bind H5 hardening checks to exempted bucket (replaces #174) by kerberosmansour Β· Pull Request #175 Β· kerberosmansour/hulumi
Replacement for #174 β same H5 policy fix, but with the DCO sign-off and Prettier formatting that #174 was missing. Opened as a fresh PR rather than force-pushing the bot branch's history (...
π¨ CVE-2026-48035
Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers using AccountFoundation could ship an AWS account whose CloudTrail / Config audit logs were deletable by any S3-delete-capable principal β while believing the startup-hardened tier guaranteed tamper-resistance. Sandbox-tier deployments had no audit immutability at all (defects 1 and 3 compounded). This issue has been patched in version 1.4.0.
π@cveNotify
Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers using AccountFoundation could ship an AWS account whose CloudTrail / Config audit logs were deletable by any S3-delete-capable principal β while believing the startup-hardened tier guaranteed tamper-resistance. Sandbox-tier deployments had no audit immutability at all (defects 1 and 3 compounded). This issue has been patched in version 1.4.0.
π@cveNotify
GitHub
security: fix 4 HIGH + 15 MEDIUM Codex findings (8 root-cause clusters) β DCO-signed replacement for #177 by kerberosmansour Β·β¦
Replacement for #177 β identical changes, but every commit now carries a Signed-off-by (the cherry-picked worktree commits were missing DCO sign-off in #177). Opened as a fresh PR rather than force...
π¨ CVE-2026-48036
Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as "all clear" β masking real attacks for up to six hours β or see ordinary provider-version churn falsely promoted to incident severity. Either way, the verdict source was unreliable for downstream incident workflows that gate on it. This issue has been patched in version 1.4.0.
π@cveNotify
Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as "all clear" β masking real attacks for up to six hours β or see ordinary provider-version churn falsely promoted to incident severity. Either way, the verdict source was unreliable for downstream incident workflows that gate on it. This issue has been patched in version 1.4.0.
π@cveNotify
GitHub
security: fix 4 HIGH + 15 MEDIUM Codex findings (8 root-cause clusters) β DCO-signed replacement for #177 by kerberosmansour Β·β¦
Replacement for #177 β identical changes, but every commit now carries a Signed-off-by (the cherry-picked worktree commits were missing DCO sign-off in #177). Opened as a fresh PR rather than force...
π¨ CVE-2026-48037
Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture. This issue has been patched in version 1.4.0.
π@cveNotify
Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture. This issue has been patched in version 1.4.0.
π@cveNotify
GitHub
security: fix 4 HIGH + 15 MEDIUM Codex findings (8 root-cause clusters) β DCO-signed replacement for #177 by kerberosmansour Β·β¦
Replacement for #177 β identical changes, but every commit now carries a Signed-off-by (the cherry-picked worktree commits were missing DCO sign-off in #177). Opened as a fresh PR rather than force...
π¨ CVE-2026-54342
In epa4all, prior to version 2026-05-20, an attacker on the network path between epa4all and any backend (ePA Aktensystem, Konnektor, IDP, TSS) can present a self-signed TLS certificate and intercept the connection. For non-VAU connections (Konnektor, IDP), this allows direct read and modification of the inner traffic, including smartcard operations and OIDC authentication exchanges. For the ePA backend, the disabled TLS verification is the transport-level enabler for the VAU MITM described in GHSA-vvh7-x6c7-46gh. This issue has been patched in version 2026-05-20.
π@cveNotify
In epa4all, prior to version 2026-05-20, an attacker on the network path between epa4all and any backend (ePA Aktensystem, Konnektor, IDP, TSS) can present a self-signed TLS certificate and intercept the connection. For non-VAU connections (Konnektor, IDP), this allows direct read and modification of the inner traffic, including smartcard operations and OIDC authentication exchanges. For the ePA backend, the disabled TLS verification is the transport-level enabler for the VAU MITM described in GHSA-vvh7-x6c7-46gh. This issue has been patched in version 2026-05-20.
π@cveNotify
GitHub
Release 2026-05-20 Β· med-united/epa4all
Full Changelog: 2026-05-18...2026-05-20
π¨ CVE-2026-4267
The Query Monitor β The developer tools panel for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the β$_SERVER['REQUEST_URI']β parameter in all versions up to, and including, 3.20.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
π@cveNotify
The Query Monitor β The developer tools panel for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the β$_SERVER['REQUEST_URI']β parameter in all versions up to, and including, 3.20.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
π@cveNotify
π¨ CVE-2026-5198
A vulnerability was determined in code-projects Student Membership System 1.0. The impacted element is an unknown function of the file /admin/index.php of the component Admin Login. This manipulation of the argument username/password causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
π@cveNotify
A vulnerability was determined in code-projects Student Membership System 1.0. The impacted element is an unknown function of the file /admin/index.php of the component Admin Login. This manipulation of the argument username/password causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
π@cveNotify
π¨ CVE-2026-34532
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.67 and 9.7.0-alpha.11, an attacker can bypass Cloud Function validator access controls by appending "prototype.constructor" to the function name in the URL. When a Cloud Function handler is declared using the function keyword and its validator is a plain object or arrow function, the trigger store traversal resolves the handler through its own prototype chain while the validator store fails to mirror this traversal, causing all access control enforcement to be skipped. This allows unauthenticated callers to invoke Cloud Functions that are meant to be protected by validators such as requireUser, requireMaster, or custom validation logic. This issue has been patched in versions 8.6.67 and 9.7.0-alpha.11.
π@cveNotify
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.67 and 9.7.0-alpha.11, an attacker can bypass Cloud Function validator access controls by appending "prototype.constructor" to the function name in the URL. When a Cloud Function handler is declared using the function keyword and its validator is a plain object or arrow function, the trigger store traversal resolves the handler through its own prototype chain while the validator store fails to mirror this traversal, causing all access control enforcement to be skipped. This allows unauthenticated callers to invoke Cloud Functions that are meant to be protected by validators such as requireUser, requireMaster, or custom validation logic. This issue has been patched in versions 8.6.67 and 9.7.0-alpha.11.
π@cveNotify
GitHub
fix: Cloud function validator bypass via prototype chain traversal ([β¦ Β· parse-community/parse-server@4fc48cf
β¦GHSA-vpj2-qq7w-5qq6](https://github.com/parse-community/parse-server/security/advisories/GHSA-vpj2-qq7w-5qq6)) (#10343)
π¨ CVE-2026-4799
In Search Guard FLX up to version 4.0.1, it is possible to use specially crafted requests to redirect the user to an untrusted URL.
π@cveNotify
In Search Guard FLX up to version 4.0.1, it is possible to use specially crafted requests to redirect the user to an untrusted URL.
π@cveNotify
Search-Guard
Security for Elasticsearch | Search Guard FLX 4.1.0 | Search Guard
Changelog for Search Guard FLX 4.1.0
π¨ CVE-2026-22561
Uncontrolled search path elements in Anthropic Claude for Windows installer (Claude Setup.exe) versions prior to 1.1.3363 allow local privilege escalation via DLL search-order hijacking. The installer loads DLLs (e.g., profapi.dll) from its own directory after UAC elevation, enabling arbitrary code execution if a malicious DLL is planted alongside the installer.
π@cveNotify
Uncontrolled search path elements in Anthropic Claude for Windows installer (Claude Setup.exe) versions prior to 1.1.3363 allow local privilege escalation via DLL search-order hijacking. The installer loads DLLs (e.g., profapi.dll) from its own directory after UAC elevation, enabling arbitrary code execution if a malicious DLL is planted alongside the installer.
π@cveNotify
Anthropic
Anthropic Trust Center
Anthropic is an AI safety and research company with a mission of ensuring the world safely makes the transition through transformative AI. We believe deeply in transparency and the need for secure practices in this rapidly evolving industry.
π¨ CVE-2026-22569
An incorrect startup configuration of affected versions of Zscaler Client Connector on Windows may cause a limited amount of traffic from being inspected under rare circumstances.
π@cveNotify
An incorrect startup configuration of affected versions of Zscaler Client Connector on Windows may cause a limited amount of traffic from being inspected under rare circumstances.
π@cveNotify
π¨ CVE-2026-30276
An arbitrary file overwrite vulnerability in DeftPDF Document Translator v54.0 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.
π@cveNotify
An arbitrary file overwrite vulnerability in DeftPDF Document Translator v54.0 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.
π@cveNotify
Deftpdf
DeftPDF | Free PDF Software to Edit, Convert, Sign & More.
An all-in-one free online PDF editor that does not require subscriptions or installations! DeftPDF is a free online tool that makes editing and converting easy in just a few clicks!
π¨ CVE-2026-30281
An arbitrary file overwrite vulnerability in MaruNuri LLC v2.0.23 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.
π@cveNotify
An arbitrary file overwrite vulnerability in MaruNuri LLC v2.0.23 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.
π@cveNotify
GitHub
neo.maru APP Arbitrary File Overwrite Vulnerability Β· Issue #21 Β· Secsys-FDU/AF_CVEs
VendorοΌMaruNuri LLC (https://maru.xyz/) Affected productοΌneo.maru (https://play.google.com/store/apps/details?id=neo.maru) VersionοΌV2.0.23 Google Play linkοΌhttps://play.google.com/store/apps/detail...
π¨ CVE-2026-30284
An arbitrary file overwrite vulnerability in UXGROUP LLC Voice Recorder v10.0 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.
π@cveNotify
An arbitrary file overwrite vulnerability in UXGROUP LLC Voice Recorder v10.0 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.
π@cveNotify
App Craze
App Craze β Discover & Enjoy Smart, Stylish Mobile Apps
Download App Craze and explore a world of innovative, easy-to-use mobile and web apps designed to simplify your digital life. Simple to use. Fun to explore.