CVE Vulnerability Catalog

Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/Negotiate-authenticated backend connections to their frontend connection. Unauthenticated clients can be handed a pooled keep-alive backend connection where a victim completed an NTLM or Negotiate handshake, letting them read victim data and act as that victim.

Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider. The HTTP router generated for ssl-passthrough Ingresses on non-TLS entry points never applies the Ingress's access-control annotations, allowing unauthenticated attackers to access backends protected by auth-type, auth-url, or whitelist-source-range annotations with nothing logged.

Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests with the :scheme http pseudo-header over TLS on Go 1.27 builds to reach routers requiring client certificates without presenting one.

In oretom23 php-travel-agency-system, admin/insert.php in the Insertion Handler is vulnerable to SQL injection via manipulation of the costomer_id, payment_type, amount, description, user, uploadimage, full_name, and visa_no arguments. The attack can be launched remotely, a public exploit is available, and the project has not responded to the report.

GitLab CE/EE versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 contain improper input sanitization in the LDAP email lookup path used during OmniAuth identity linking. When OmniAuth SAML and LDAP auto-linking are both enabled, an authenticated user can take over an existing LDAP-backed account without victim interaction.

GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 contains a vulnerability where an unauthenticated user could poison a shared cache's OAuth/OIDC discovery document to redirect certain flows to an externally controlled server, due to improper trust of user-supplied values when constructing endpoint URLs in cached discovery responses.

Cisco conducted an internal security review resulting in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76530 relate to the use of non-canonical URL paths for authorization decisions (CWE-647).

Cisco conducted an internal security review resulting in a software hardening release that addresses multiple internally discovered vulnerabilities. CVE-2026-76526 relates to improper neutralization (CWE-707).

In Splunk SOAR versions below 8.7.0, a user holding a role with the Users and Roles view permission could use the REST API to infer authentication token values for other users. If the inferred token grants administrative access, that user could gain administrative access to the Splunk SOAR instance. The vulnerability is possible because the REST API accepts caller-controlled query filters on sensitive user record fields.

In Splunk SOAR versions below 8.7.0, a user with the "Observer" role could use REST API query filters to infer password hashes and authorization tokens for other users. The disclosure occurs because query filters are applied to user records before sensitive fields are protected.

Cisco conducted an internal security review resulting in a software hardening release that addresses multiple internally discovered vulnerabilities. CVE-2026-76300 relates to improper control of a resource through its lifetime (CWE-664).

In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user without the admin or power Splunk roles could derive the PostgreSQL sidecar database superuser password and run arbitrary OS commands as the account running Splunk Enterprise on search head cluster members. The flaw exists because the PostgreSQL sidecar service derives a privileged database password from the search head cluster identifier that appears in search job logs.

In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user holding a role with the edit_manager_xml capability can execute arbitrary operating-system commands with the permissions of the account running Splunk Enterprise by opening the affected configuration in Splunk Web Manager. The vulnerability exists because Splunk Web evaluates user-controlled expressions from Manager XML without sufficiently restricting expression syntax.

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user holding a role with the schedule_search capability could bypass the expected safeguards in the scheduled search workflow. The user could then run risky Search Processing Language (SPL) commands that disclose or alter Splunk Enterprise data or disrupt Splunk Enterprise availability. The vulnerability is possible because the Splunk Enterprise search scheduler does not apply SPL safeguards for risky commands to scheduled searches.

In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthenticated user could send repeated requests to the Edge Processor package download endpoint in the Splunk Pipeline Builders app. The requests could cause the Splunk daemon to consume excessive system resources and potentially stop responding. The vulnerability is possible because the endpoint accepts package download requests without authentication and reads and base64-encodes the complete package in memory for each request.

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint and cause Splunk Web to stop responding to requests. Splunk Web remains unavailable until Splunk Enterprise is restarted. The vulnerability is possible because Splunk Web does not limit request-header parsing before processing the request.

php-travel-agency-system (oretnom23) in admin/update.php contains an SQL injection vulnerability via manipulation of the action, full_name, visa_no, hiden, title, description, page_id, and user arguments. The attack can be launched remotely and the exploit is publicly available.

php-travel-agency-system (oretnom23) in admin/delete.php contains an SQL injection vulnerability via manipulation of the costomer_id, ticket_id, payment_id, id, document_id, salary_id, emp_id, and user_id arguments. The attack can be launched remotely and the exploit is publicly available.

A vulnerability was determined in oretnom23 php-travel-agency-system. Affected is some unknown functionality of the file admin/session.php of the Session Handler component. Manipulation of the user_id argument can lead to missing authentication. The attack can be launched remotely, and the exploit has been publicly disclosed.

Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 lack authentication in the enrollment status handler (GET /enroll/status). An unauthenticated remote attacker can retrieve an approved peer's signed Biscuit identity token by supplying a peer_id from the unauthenticated GET /info endpoint, then replay it as a bearer credential to read authorization policies and overwrite router multiaddrs.