CoreDNS versions prior to 1.14.3 have a vulnerability in TSIG authentication handling on gRPC, QUIC, DoH, and DoH3 transports. The gRPC and QUIC transports verify only the TSIG key name but do not validate the HMAC, allowing requests with forged MACs to bypass authentication if the key name matches. The DoH and DoH3 transports do not verify TSIG at all, accepting any TSIG record regardless of key name or MAC validity. This flaw enables attackers to bypass TSIG authentication and access TSIG-protected operations such as zone transfers and dynamic updates.
CoreDNS versions prior to 1.14.3 have a vulnerability in the tsig plugin where TSIG authentication can be bypassed on encrypted transports such as DoT, DoH, DoH3, DoQ, and gRPC. This occurs because these transports do not properly verify TSIG signatures and instead trust the transport writer's TsigStatus(), which always returns nil, allowing unauthenticated clients to bypass TSIG-based access controls.
CoreDNS versions prior to 1.14.3 contain a vulnerability in the transfer plugin where the selection of ACL stanzas for zone transfers uses lexicographic comparison instead of longest zone match. This flaw allows a permissive parent zone transfer rule to override a more restrictive subzone rule, enabling unauthorized clients to perform zone transfers (AXFR/IXFR) on subzones that should be restricted. The issue is fixed in version 1.14.3.
CoreDNS DNS-over-QUIC (DoQ) server has a vulnerability where a remote unauthenticated attacker can cause excessive goroutine and memory growth by opening many QUIC streams and stalling after sending only 1 byte. This leads to unbounded goroutine backlog and blocked workers due to missing per-stream read deadlines, resulting in a denial-of-service (DoS) condition via memory exhaustion and potential crash.
Fiber v3 cache middleware's default key generator uses only the request path, ignoring the query string. This causes distinct requests with different query parameters to share the same cached response, leading to response mix-up. Such behavior can leak or corrupt user-specific content when responses depend on query parameters. The issue affects versions prior to 3.2.0 and has been fixed in version 3.2.0.
Netmaker versions prior to 1.5.0 contain a vulnerability in the VerifyHostToken function where JWT signatures for host tokens are not properly validated. This allows an attacker to forge JWTs with arbitrary claims and retrieve sensitive host configuration data. The issue is fixed in version 1.5.0.
An integer overflow or wraparound vulnerability exists in the Apache Thrift TFramedTransport implementation for the Go language. This affects versions prior to 0.23.0. The issue is resolved by upgrading to version 0.23.0.
Ollama versions up to 0.20.2 contain a path traversal vulnerability in the digestToPath function of the Tensor Model Transfer Handler component. This flaw allows remote attackers to manipulate the digest argument to perform path traversal. Exploitation is considered difficult and requires high complexity. Public exploit code is available, but no vendor response or patch has been provided.
Note-mark v0.19.2 contains a vulnerability where notes and assets in soft-deleted public books remain accessible to unauthenticated users. Although the book endpoint returns a 404 after soft deletion, the notes and assets are still served due to improper filtering in raw SQL joins that do not respect the soft-delete status of the parent book. This allows anyone with the note ID or slug path to read the content despite the owner's intent to revoke access.
A critical authentication bypass vulnerability exists in note-mark backend versions prior to 0.0.0-20260417132909-dea5530cc989. The function IsPasswordMatch uses a hard-coded bcrypt hash of the string "null" as a fallback for users with empty passwords, which includes OIDC-registered users. An attacker can submit the password "null" to the internal login endpoint to gain unauthorized access to any OIDC-only user account without authentication. This allows reading and modifying the victim's data and setting a new password, effectively taking over the account. The vulnerability is present when internal login is enabled (default) alongside OIDC user creation. A patch is available that rejects login attempts for users with no stored password.
A vulnerability (CVE-2026-6993) exists in go-kratos kratos versions up to 2.9.2 affecting the NewServer function in transport/http/server.go. This flaw involves the http.DefaultServeMux fallback handler and results in a confused deputy issue, allowing unintended intermediary behavior. The vulnerability can be exploited remotely without authentication. Public exploit code is available. A patch identified by commit 0284a5bcf92b5a7ee015300ce3051baf7ae4718d addresses the issue.
PicoClaw versions up to 0.2.4 contain a command injection vulnerability in the Web Launcher Management Plane component, specifically in the /api/gateway/restart endpoint. This flaw allows remote attackers to execute arbitrary commands by manipulating input to this API. The vulnerability was reported early to the project but has not yet been addressed or patched.
A timing side-channel vulnerability exists in Traefik's BasicAuth middleware that allows attackers to enumerate valid usernames by measuring response time differences. The issue arises because a fallback secret intended for constant-time comparison is always empty, causing the comparison to short-circuit quickly and reveal timing differences between valid and invalid usernames. This vulnerability affects multiple versions of Traefik prior to fixed releases. A patch is available to address this issue.
A vulnerability in Traefik's Kubernetes CRD provider allows unauthorized cross-namespace middleware binding when the 'allowCrossNamespace' setting is false. Specifically, middleware references nested inside a 'Chain' middleware's specification can bypass the cross-namespace restriction, enabling an actor with permission to create or update CRDs in their own namespace to reference middleware from other namespaces. This bypasses the intended isolation boundary and can lead to unauthorized middleware application across namespaces.
A critical authentication bypass vulnerability exists in Traefik's ForwardAuth and snippet-based authentication middleware due to incomplete sanitization of forwarded headers. Traefik only sanitizes canonical header names like 'X-Forwarded-Proto' but does not normalize or strip alias headers using underscores (e.g., 'X_Forwarded_Proto'). Attackers can exploit this by injecting spoofed trust context through these alias headers, bypassing authentication on protected routes without valid credentials. This issue arises from a mismatch between Traefik's header handling and downstream authentication services that normalize header names equivalently. Fixed versions are available in Traefik releases 2.11.43, 3.6.14, and 3.7.0-rc.2.
Traefik's ForwardAuth middleware has a critical authentication bypass vulnerability when configured with trustForwardHeader=false and deployed behind a trusted upstream proxy. The vulnerability arises because the X-Forwarded-Prefix header is not stripped or rebuilt, allowing an attacker to spoof this header and bypass authentication if the auth service relies on it for authorization decisions. This can lead to unauthorized access to protected backend routes. The issue affects multiple versions of Traefik prior to fixed releases and has been confirmed with a CVSS score of 10.0.
Dgraph version 25.3.2 and earlier expose the process command line, including the admin token, via the unauthenticated /debug/vars endpoint on the Alpha service. This allows an unauthenticated attacker to retrieve the admin token supplied at startup and use it to bypass authentication by replaying it in the X-Dgraph-AuthToken header. The vulnerability is a variant of a previously fixed issue but remains due to incomplete mitigation. The flaw enables unauthorized administrative access to privileged endpoints.
A critical injection vulnerability in Dgraph allows unauthenticated attackers to exfiltrate the entire database when ACL is disabled (default configuration). The flaw arises from improper sanitization of the 'cond' field in upsert mutations, enabling injection of additional DQL query blocks that execute server-side and return data in HTTP responses. This bypasses authentication and authorization checks, leading to full read access and potential manipulation of mutation logic. The vulnerability affects versions prior to 25.3.3, 24.1.8, and 1.2.8.
Grafana Tempo versions 1.3.0 through before 2.8.4, 2.9.0 through before 2.9.2, and 2.10.0 through before 2.10.2 contain an uncontrolled resource consumption vulnerability. Queries with large limits can cause excessive memory allocation, potentially impacting service availability. A fix is available in versions 2.8.4, 2.9.2, and 2.10.2. Mitigation includes configuring max_result_limit to restrict query size.
Ntfy.sh versions prior to 2.22.0 contain a critical vulnerability in the parseActions function that allows remote attackers to execute arbitrary code. This flaw is identified as CVE-2026-39087 and has a CVSS score of 9.8, indicating a high severity with network attack vector and no required privileges or user interaction. The issue has been fixed in version 2.22.0.