Daptin's authentication system has a session invalidation vulnerability where JSON Web Tokens (JWTs) remain valid after a user changes their password. The JWT validation middleware does not verify if the token was issued before the most recent password change, allowing old tokens to retain full access. The password update process hashes the new password but does not revoke or blacklist existing tokens or invalidate the authentication cache. This flaw negates password rotation as an effective security control.
Argo CD versions 3.2.0 through before 3.2.11 and 3.3.0 through before 3.3.9 have a vulnerability in the ServerSideDiff endpoint that allows users with read-only access to extract plaintext Kubernetes Secret data. This occurs due to missing authorization and data masking when the application annotation argocd.argoproj.io/compare-options: IncludeMutationWebhook=true is set, which disables a defense mechanism that normally strips sensitive data. The vulnerability leverages the Kubernetes Server-Side Apply dry-run mechanism to expose secret values stored in etcd.
Amazon ECS Container Agent for Windows versions 1.47.0 through 1.102.2 contains a command injection vulnerability in the FSx Windows File Server volume mounting process due to improper input validation of credentials. This flaw allows a remote authenticated attacker with permissions to register ECS task definitions or write to Secrets Manager or SSM Parameter Store credentials to execute shell commands with SYSTEM privileges on the host. The issue is fixed in version 1.103.0. ECS on Fargate is not affected.
The AxonFlow SDK for Go versions 5.6.1 and below did not expose the HMAC-SHA256 signing key via its typed API, preventing webhook receivers from verifying the authenticity of incoming webhook payloads. This flaw allowed attackers who discovered the webhook URL to forge webhook deliveries indistinguishable from legitimate ones, potentially causing unauthorized actions in the receiving application. The issue is fixed in version 5.7.0, which exposes the signing key for proper signature verification.
Multiple security vulnerabilities affecting AxonFlow platform versions prior to 7.5.0 have been fixed in version 7.5.0. These include multi-tenant isolation failures, cross-tenant data leaks, license validation bypass, authentication bypass, information disclosure, denial of service via unbounded request bodies, and a SQL injection enforcement regression affecting the Community SaaS endpoint. The vulnerabilities could lead to unauthorized data access, policy enforcement bypass, denial of service, and potential SQL injection attacks. The vendor recommends upgrading to version 7.5.0 or later, which addresses all these issues with no required configuration changes.
MediaMTX versions from 1.15.0 up to but not including 1.18.0 are affected by CVE-2026-27143, a vulnerability stemming from a vulnerable dependency. The issue is resolved in version 1.18.0. The vulnerability has a medium severity with a CVSS 4.0 base score of 6.9.
CVE-2026-44349 is a SQL injection vulnerability in the Daptin API's fuzzy search functionality. The vulnerability arises because the user-supplied column names in fuzzy search queries are directly interpolated into raw SQL without proper whitelist validation. This allows any authenticated user, including self-registered non-admin users, to perform unauthorized database reads. The flaw affects multiple database backends including SQLite, PostgreSQL, MySQL, and MSSQL, with confirmed dynamic exploitation on SQLite and PostgreSQL. A fix is available in Daptin version 0.11.5 that adds proper column name validation.
kube-router versions prior to 2.9.0 run a GoBGP gRPC management server bound to the node's primary IP address without authentication or TLS. This allows any pod in the cluster to access the gRPC API on port 50051 and perform unauthorized actions such as injecting arbitrary BGP routes, enumerating BGP peer configurations, adding or deleting BGP neighbors, and modifying routing policies. Although kube-router's default BGP export policy limits route propagation, the vulnerability enables local BGP state manipulation on nodes, which could impact cluster networking. A fix is available in version 2.9.0 that addresses this exposure.
A critical vulnerability in Mezo's ERC-20 bridgeOut precompile allows an attacker to repeatedly drain the Layer 1 bridge without reducing their Mezo balance. This occurs due to a state management flaw where inner StateDB burns are overwritten by stale outer StateDB storage, restoring the attacker's balance and allowance while the bridge unlock event is recorded and triggers token release on L1. The flaw enables repeated full drains of bridged ERC-20 tokens such as USDC on Ethereum mainnet. A fixed version (8.0.0) has been deployed.
Velociraptor versions prior to 0.76.4 have an authorization bypass vulnerability in the HTTP API. A user with only the reader role in the root organization can read files from other organizations without explicit permissions. This issue does not allow users with sub-organization read access to read from other organizations or the root organization. The vulnerability is fixed in version 0.76.4.
Nginx-UI versions prior to 2.3.8 have a critical unauthenticated remote code execution vulnerability via the backup restore API endpoint. During the first 10 minutes after startup or any restart, the restore endpoint allows unauthenticated attackers to upload a crafted backup archive that overwrites configuration files, including app.ini. This enables injection of arbitrary OS commands via the TestConfigCmd setting, which are executed as the user running nginx-ui, often root in Docker environments. The vulnerability arises from a time-limited authentication bypass, lack of validation on restored files, and attacker-controlled cryptographic keys that bypass integrity checks. Frequent container restarts make the 10-minute unauthenticated window effectively persistent.
The Nginx-UI Settings API (CVE-2026-42223) improperly exposes protected secret fields in its GetSettings API endpoint. Although many sensitive fields are tagged as protected, this protection is only enforced during settings writes, not reads. As a result, authenticated users can retrieve over 40 protected fields including JwtSecret, NodeSecret, OIDC ClientSecret, and IP whitelist configurations. This exposure allows attackers to forge authentication tokens, impersonate cluster nodes, and potentially take over OAuth accounts.
An unauthenticated bootstrap takeover vulnerability exists in nginx-ui version 2.3.5 during the initial installation window via the POST /api/install endpoint. This endpoint is accessible without authentication when the instance is uninitialized, allowing an attacker to submit bootstrap data that sets the application's JWT secret, node secret, certificate email, and initial administrator credentials. The vulnerability allows an attacker with network access to a fresh instance within the initial setup window (approximately 10 minutes) to claim administrative control before the legitimate operator. This issue is limited to the initial setup phase and does not affect post-install instances.
An unauthenticated attacker can claim the initial administrator account on a fresh nginx-ui instance during the first-run setup window via the public /api/install endpoint. This allows permanent takeover of the initial admin account if the attacker acts before the legitimate operator. The vulnerability exists because the installation endpoint does not require authentication and only enforces a 10-minute window after startup. The attacker can set admin credentials, overwriting user ID 1, which always exists. This impacts nginx-ui versions from 2.0.0 up to but not including 2.3.8.
Velocidex Velociraptor versions prior to 0.76.5 contain an off-by-one error in the ConsumeUnit16Array and ConsumeUnit64Array functions. This flaw can be triggered by a local attacker supplying a specially crafted .evtx file to the parse_evtx VQL plugin, causing a denial of service via process crash. The issue affects both Windows and Linux platforms. A fix is available in version 0.76.5.
Velocidex Velociraptor versions prior to 0.76.5 contain an authorization bypass vulnerability in the GetUserRoles gRPC API endpoint. This flaw allows any authenticated user with low privileges to retrieve the complete access control list (ACL) policy, including roles and permissions, for any user across all organizations by manipulating the Name and Org parameters in a network request. The vulnerability has been assigned CVE-2026-7573 and is rated medium severity with a CVSS score of 5. A fix is available in version 0.76.5.
authd versions 0.6.0 through before 0.6.4 contain a bug where the primary group ID (GID) of a user can be incorrectly set to their user ID (UID) upon login if certain conditions are met. This affects users whose UID and primary GID differ, potentially causing local privilege escalation and improper file group ownership. A fix is available in version 0.6.4.
A vulnerability in github.com/apernet/hysteria/core/v2 allows a valid authenticated user to crash the server by causing an out-of-memory (OOM) condition when the sniff feature is enabled. This occurs because the server allocates memory based on a crafted QUIC packet's crypto length, which can be maliciously large.
A vulnerability in GoBGP v4.4.0 through v4.4.x allows an unauthenticated remote BGP peer to cause a denial of service by sending a malformed BGP UPDATE message. The malformed message triggers a nil pointer dereference in the AdjRib.Update function, causing the GoBGP process to crash and resulting in loss of service availability. This issue is fixed in version 4.5.0.
CVE-2026-41685 is a vulnerability in Incus server versions up to 6.23.0 where authenticated users can upload unbounded amounts of binary data via certain import endpoints. This causes the server to write large temporary files directly to the host filesystem without size limits, potentially exhausting disk space and causing denial of service. The impact is limited for users employing storage.images_volume or storage.backups_volume, which isolate uploads from the host filesystem. The vulnerability affects instance backup import, storage bucket import, and storage volume import flows. No public exploits or patches are currently available.