Schwachstellen, die jetzt zählen.

Traccar 3.15 before 6.17.0 contains an authentication bypass vulnerability in LdapProvider.login() that fails to reject empty passwords, causing LDAP binds to…

Traccar 3.15 before 6.17.0 contains an authentication bypass vulnerability in LdapProvider.login() that fails to reject empty passwords, causing LDAP binds to be performed as unauthenticated binds when LDAP authentication is enabled. Unauthenticated attackers who know a valid username can log in via POST /api/session or HTTP Basic authentication with an empty password against directories that permit unauthenticated binds, obtaining sessions for any account including…

@tinacms/mdx before 2.4.2 contains a code injection vulnerability in its MDX serializer, which writes rich-text values into MDX expressions without escaping…

@tinacms/mdx before 2.4.2 contains a code injection vulnerability in its MDX serializer, which writes rich-text values into MDX expressions without escaping them. Authenticated content editors can save crafted values that break out of list field or highlightColor expressions in the stored .mdx file, executing JavaScript in visitors' browsers or on build and server-side rendering hosts.

OpsTree REMS through 1.0.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access Governance API endpoints…

OpsTree REMS through 1.0.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access Governance API endpoints, including /api/v1/databases. Attackers can send requests without an Authorization header, or with invalid or tampered JWT tokens, to retrieve stored database hosts, usernames, and passwords.

OpsTree REMS through 1.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid JWTs by setting the…

OpsTree REMS through 1.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid JWTs by setting the client-controlled is_local_auth field. Attackers can send a POST /api/v1/user/login/ request for the admin account with an invalid password and is_local_auth true to gain SuperUser administrative access.

Node.js: Mehrere Schwachstellen

nodejs: nodejs: Denial of service via premature socket closure during TLS handshake

Node.js: Mehrere Schwachstellen

nodejs: nodejs: Denial of Service via cancelled HTTP/2 file downloads

Node.js: Mehrere Schwachstellen

nodejs: nodejs: Denial of Service via HTTP/2 use-after-free

Node.js: Mehrere Schwachstellen

nodejs: Node.js: Client certificate authentication bypass via TLS renegotiation

Node.js: Mehrere Schwachstellen

nodejs: nodejs: Certificate validation bypass via TLS session cache reuse

Node.js: Mehrere Schwachstellen

nodejs: Node.js: Information disclosure via invalid proxy configuration error messages

Node.js: Mehrere Schwachstellen

nodejs: nodejs: Denial of service via HTTP/2 memory exhaustion

Node.js: Mehrere Schwachstellen

nodejs: Node.js: Mutual TLS authorization bypass via incomplete SNI context configuration

Node.js: Mehrere Schwachstellen

nodejs: Node.js: Information disclosure via use-after-free during HTTP/2 stream teardown

Node.js: Mehrere Schwachstellen

nodejs: Node.js: Denial of service via HTTP/2 session resource leak during shutdown

Node.js: Mehrere Schwachstellen

nodejs: nodejs: Information disclosure via HTTPS parser re-entrancy

Node.js: Mehrere Schwachstellen

nodejs: Node.js: Denial of Service via improper HTTP/2 session teardown

Node.js: Mehrere Schwachstellen

nodejs: Node.js: Denial of service via abrupt disconnection during zlib compression

Node.js: Mehrere Schwachstellen

nodejs: Node.js: Information disclosure via improper permission checks in recursive file watching

Node.js: Mehrere Schwachstellen

nodejs: nodejs: Denial of Service via HTTP/2 Alt-Svc heap buffer overflow

During an internal security assessment, a potential vulnerability was discovered in Lenovo PC Manager, distributed exclusively in the Chinese market, that…

A deserialization of untrusted data vulnerability was discovered in Lenovo System Update that could allow a local authenticated user to execute code with…

An improper permissions vulnerability was reported in Lenovo System Update that could allow a local authenticated user to execute code with elevated privileges.

A potential vulnerability was reported in some Lenovo Tablets that could allow a third-party application to perform an arbitrary file write with elevated…

Missing authentication for critical function and Improper validation of integrity check value vulnerability in Sipay Electronic Money and Payment Services Inc.

Missing authentication for critical function and Improper validation of integrity check value vulnerability in Sipay Electronic Money and Payment Services Inc. WooCommerce Virtual POS Module allows Authentication Bypass and Application API Message Manipulation via Man-in-the-Middle. This issue affects WooCommerce Virtual POS Module: from 26.8.3 before 26.9.1.

Apache HTTP Server: Mehrere Schwachstellen

NULL pointer dereference vulnerability in Apache HTTP Server's mod_md during HTTP request processing. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.69.

Apache HTTP Server: Mehrere Schwachstellen

Stack-based buffer overflow vulnerability in Apache HTTP Server's mod_vhost_alias (after CVE-2026-63292) This issue affects Apache HTTP Server: 2.4.69.

ansible.posix: authorized_key module follows a parent-directory symlink allowing writes outside the intended directory

aap-gateway-operator: resource-server secret exposed in plaintext in the AutomationController custom resource

awx: webhook credential assignment omits use_role check, exposing another user's token

ansible-pylibssh: accepts a changed SSH host key when host_key_auto_add is enabled