[{"data":1,"prerenderedAt":64},["ShallowReactive",2],{"sicherheitsluecke-cve-2026-102895":3},{"l":4,"details":29,"weitere":39,"indexierbar":62,"updated":63},{"cve":5,"status":6,"vendor":7,"product":7,"name":8,"added":9,"due":10,"ransomware":11,"published":12,"cwes":13,"cvss":17,"epss":22,"slug":25,"bereich":26,"schweregrad":27,"art":28,"produktLabel":7},"CVE-2026-102895","ausgenutzt","GPUStack","GPUStack Improper Authentication Vulnerability","2026-11-09","2026-11-12",false,"2026-11-04",[14,15,16],"CWE-287","CWE-290","CWE-346",{"version":18,"score":19,"severity":20,"vector":21},"3.1",9.8,"CRITICAL","CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"score":23,"percentile":24},0.00555,0.46664,"cve-2026-102895","dev","kritisch","Fehlerhafte Anmeldung (Authentifizierung)",{"description":30,"refs":31},"GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in gpustack\u002Fapi\u002Fauth.py treated a loopback request source as the built-in administrator when force_auth_localhost was false, which was the default. A remote request could appear to originate from 127.0.0.1 because client_ip_getter accepted a same-host reverse proxy peer or a client-supplied X-GPUStack-Real-IP loopback value. The bypass allowed unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST \u002Fv2\u002Finference-backends\u002Ffrom-yaml. Exploitation was observed in the wild against a 2.1.1 deployment. This issue is fixed in version 2.2.0.",[32,35,37],{"url":33,"host":34},"https:\u002F\u002Fgithub.com\u002Fgpustack\u002Fgpustack\u002Fcommit\u002F53f42a6a553542974396d16a4ff6b12bcbedb48d","github.com",{"url":36,"host":34},"https:\u002F\u002Fgithub.com\u002Fgpustack\u002Fgpustack\u002Fpull\u002F5346",{"url":38,"host":34},"https:\u002F\u002Fgithub.com\u002Fgpustack\u002Fgpustack\u002Fsecurity\u002Fadvisories\u002FGHSA-gj9m-f8ph-pmhr",[40,49,57],{"cve":41,"status":6,"produktLabel":42,"vendor":43,"product":44,"art":45,"bereich":26,"schweregrad":27,"score":46,"epss":47,"added":48,"ransomware":11},"CVE-2026-97229","GitLab Community Edition and Enterprise Edition","GitLab","Community Edition and Enterprise Edition","Zahlenüberlauf (Integer Overflow)",10,0.6522,"2026-10-29",{"cve":50,"status":6,"produktLabel":51,"vendor":51,"product":51,"art":52,"bereich":26,"schweregrad":53,"score":54,"epss":55,"added":56,"ransomware":11},"CVE-2023-22894","Strapi","Vertrauliche Daten unverschlüsselt gespeichert","mittel",4.9,0.04114,"2026-10-08",{"cve":58,"status":6,"produktLabel":42,"vendor":43,"product":44,"art":59,"bereich":26,"schweregrad":27,"score":46,"epss":60,"added":61,"ransomware":11},"CVE-2026-85706","Zugriff auf Dateien außerhalb des erlaubten Ordners (Path Traversal)",0.97355,"2026-09-11",true,"2026-11-11T14:28:43.107Z",1794407348899]