Base de CVEs

CVE-2026-110865 Alta · 7.1 CWE-424 14/10/2026

Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared Presets

Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules[].headers to inject custom HTTP headers into requests Renovate sends to other hosts.

CVE-2026-69979 Média · 5.5 CWE-424 13/10/2026

Windows AppX Deployment Service Security Feature Bypass Vulnerability

Improper protection of alternate path in Windows AppX Deployment Service allows an authorized attacker to bypass a security feature locally.

CVE-2026-107352 Alta · 7.7 CWE-424 07/10/2026

Missing authorization checks in Amazon Athena engine version 3 request handling

Missing authorization checks in Amazon Athena engine version 3 request handling could have allowed an authenticated user to read limited query metadata (AWS account identifiers and SQL statement text) from other AWS accounts. Query results, credentials, and Amazon S3 data were not affected. AWS remediated the issue on September 1, 2026, and has confirmed no customer metadata was accessed. No customer action is required.

CVE-2026-37008 Alta · 8.1 CWE-424 13/09/2026

CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong…

CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLL(None) loads the C library without relying in any import statements. In other words, a within-process sandbox cannot merely account for the import system and instead must account for the complete runtime of the Python interpreter.

CVE-2026-82754 Média · 6.3 CWE-424 07/09/2026

ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls

Improper Protection of Alternate Path vulnerability in ash-project ash_authentication_oauth2_server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix. oauth2_server_protocol_routes/1 in AshAuthentication.Phoenix.Oauth2Server.Router forwards the same ProtocolRouter at both the /oauth prefix and the /.well-known prefix. Phoenix forward strips the matched prefix before dispatch, so the full route table answers under both mounts, and POST /register, POST /token, and POST /revoke are reachable as /.well-known/register, /.well-known/token, and /.well-known/revoke. Edge controls such as WAF rules, rate limits, or authentication exemptions written against the /oauth paths, or that allow-list /.well-known as unauthenticated, do not apply to the alias. This issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1.

CVE-2026-82586 Alta · 8.2 CWE-424 07/09/2026

AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes

Improper Protection of Alternate Path vulnerability in ash-project ash_lua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list. AshLua exposes Ash resources to Lua scripts, gated by a manifest declaring which fields are exposed. The read action's operation aggregate path in AshLua.Runtime took the field name straight from the Lua call and resolved it with only String.to_existing_atom and Ash.Query.Aggregate.new!, neither of which consults the exposed-field allow-list the normal fields path enforces. A script can therefore read the value of any attribute of any record the actor may read, including private sensitive?: true columns, via resource.read({ operation = {"list", "hashed_password"} }); min and max give a value oracle. Anyone able to submit or influence a Lua script can reach this. This issue affects ash_lua: from 0.1.0 before 0.2.1.

CVE-2026-86145 Alta · 8.2 CWE-424 05/09/2026

PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a…

PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).

CVE-2026-58428 Média · 6.5 CWE-424 13/08/2026

Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

CVE-2026-66756 Crítica · 9.8 CWE-424 30/07/2026

Apache Tika: unpack endpoint in tika-server allows configuration with unsecureFeatures=false

Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1. Users are recommended to upgrade to version 4.0.0-beta-1, which fixes the issue.

CVE-2026-54423 Alta · 8.2 CWE-424 10/07/2026

In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using…

In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_raw step to send arbitrary IPMI commands to a node, bypassing Ironic's access control.

CVE-2026-0268 Média · 4.4 CWE-424 10/06/2026

Prisma Access Agent: Local Authenticated VPN Enforcement Bypass on Linux

A security control bypass vulnerability in Prisma Access Agent for Linux allows a local attacker to route network traffic outside the VPN tunnel. This does not impact Prisma Access Agent on Windows, macOS, iOS, Android, or ChromeOS.

CVE-2026-0237 Alta · 7.8 CWE-424 13/05/2026

Prisma Browser: Improperly Restricted Automation Bridge Allows Security Bypass

An improper protection of alternate path vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to an internal automation bridge. This allows a locally authenticated non-admin user to leverage an exposed communication channel to send unauthorized commands to the browser, bypassing security controls.

CVE-2026-4913 Média · 5.7 CWE-424 14/04/2026

Improper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a…

Improper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to retain access when their account has been disabled.

CVE-2026-4270 Média · 5.5 CWE-424 16/03/2026

AWS API MCP File Access Restriction Bypass

Improper Protection of Alternate Path exists in the no-access and workdir feature of the AWS API MCP Server versions >= 0.2.14 and < 1.3.9 on all platforms may allow the bypass of intended file access restriction and expose arbitrary local file contents in the MCP client application context. To remediate this issue, users should upgrade to version 1.3.9.

CVE-2025-68939 Média · 5.3 CWE-424 26/12/2025

Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions…

Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.

CVE-2025-4617 Baixa · 1.1 CWE-424 14/11/2025

Prisma Browser: Insufficient Policy Enforcement Vulnerability in Prisma Browser

An insufficient policy enforcement vulnerability in Palo Alto Networks Prisma® Browser on Windows allows a locally authenticated non-admin user to bypass the screenshot control feature of the browser. Browser self-protection should be enabled to mitigate this issue.

CVE-2025-58079 Média · 4.3 CWE-424 16/10/2025

Improper Protection of Alternate Path (CWE-424) in the AppSuite of desknet's NEO…

Improper Protection of Alternate Path (CWE-424) in the AppSuite of desknet's NEO V4.0R1.0 to V9.0R2.0 allows an attacker to create malicious AppSuite applications.

CVE-2024-58136 Crítica · 9.8 KEV Alta · 64 Exploit público CWE-424 10/04/2025

Yiiframework Yii Improper Protection of Alternate Path Vulnerability

Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.