CVE-2026-118395

Gitea 1.27.3 stopped personal access tokens restricted to public resources public-only from creating repositories through POST /api/v1/user/repos and POST /api/v1/repos/migrate, but POST /api/v1/org/org/repos, POST /api/v1/orgs/org/repos, POST /api/v1/orgs and POST /api/v1/repos/owner/repo/genera...

Craftcms-PoC-CVE-2026-31266

CVE-2026-31266 - Craft CMS Missing Authorization CVE Information Field| Value ---|--- CVE ID| CVE-2026-31266 Vendor| Pixel & Tonic Product| Craft CMS Affected Versions| self::ALLOWANONYMOUSLIVE | self::ALLOWANONYMOUSOFFLINE, ; Proof of Concept With allowAdminChanges=false curl -X POST...

CVE-2021-45232-RCE

CVE-2021-45232-RCE CVE-2021-45232-RCE - Multi-threaded batch vulnerability detection FOFA Query title="Apache APISIX Dashboard" Affected Scope Apache APISIX Dashboard 2.10.1 POC: IP:PORT/apisix/admin/migrate/export If this helps, please give the author a star before you leave, thank you! Batch...

go-dbmigrate

migrate A migration helper written in Go. Use it in your existing Golang code or run commands via the CLI. GoCode import github.com/mattes/migrate/migrate CLI go get -u github.com/mattes/migrate Features Super easy to implement Driver interface. Gracefully quit running migrations on ^C. No magic...

CVE-2021-45232-RCE

CVE-2021-45232 CVE-2021-45232 Apache apisix Dashboard api unauth rce Version: 2.10.1 Fofa: title="Apache APISIX Dashboard" POC: IP:PORT/apisix/admin/migrate/export...

PT-2026-128180

In the Linux kernel, the following vulnerability has been resolved: perf: Fix perf pmu migrate context leaving events behind perf pmu remove walks the group leaders of a CPU and PMU with perf event groups for cpu pmu, removing each one as it goes. perf remove from context takes the leader out of...

EUVD-2026-102613

The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field second-order, via restore in all versions up to, and including, 1.5.8 due to insufficient escaping on the user supplied parameter and the lack of sufficient...

PT-2026-115586

Name of the Vulnerable Software and Affected Versions spice-server affected versions not specified Description Multiple migration data handlers fail to perform bounds validation on client-supplied offsets within SPICE MSGC MIGRATE DATA messages. This allows an authenticated SPICE client to perfor...

CVE-2026-93953: Improper Neutralization of Special Elements used in an SQL Command

The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field second-order, via restore in all versions up to, and including, 1.5.8 due to insufficient escaping on the user supplied parameter and the lack of sufficient...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: clocksource: Use migratedisable to avoid calling getrandomu32 in atomic context The following bug report occurred with a PREEMPTRT kernel: BUG: sleeping function called from invalid context at kernel/locking/spinlockrt.c:48...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: migrate: correct lock ordering for hugetlb file folios Syzbot has identified a deadlock analyzed by Lance Yang: 1 Task 5749: Holds foliolock, then attempts to acquire immaprwsemread lock. 2 Task 5754: Holds immaprwsemwrite lock,...

Astra Linux – vulnerability in linux, linux-5.10, linux-5.15, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix hang in nilfslookupdirtydatabuffers Syzbot reported a hang issue in migratepagesbatch called by mbind and nilfslookupdirtydatabuffers called in the log writer of nilfs2. While migratepagesbatch locks a folio and waits...

Astra Linux – vulnerability in linux-5.10, linux-5.15, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ext4: fix idatasem unlock order in ext4indmigrate Fuzzing reports a possible deadlock in jbd2logwaitcommit. This issue occurs when an EXT4IOCMIGRATE ioctl is set to require synchronous updates because the file descriptor is opene...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: zsmalloc: Fixed races between asynchronous zspage free operations and page migration. The asynchronous zspage free worker attempts to lock the entire page list of a zspage, without protecting against page migration. Since page...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fixed NULL pointer dereferencing in svmmigratetoram ./drivers/gpu/drm/amd/amdkfd/kfdmigrate.c:985:58-62: Error: p is NULL, but it was dereferenced...

PT-2026-115369

Name of the Vulnerable Software and Affected Versions Backuply versions prior to 1.5.9 Description Backuply is subject to a second-order SQL Injection that allows authenticated users with subscriber-level access and above to escalate privileges and take full control of a site. The issue occurs wh...

CVE-2026-70400

Gitea's repository migration API accepts a public-only token when the request specifies creation of a private repository. A delegated token intended to operate only on public resources can create a private repository and migration task under the authorizing account or an organization where that...

@cedarjs/api-server-watch (>=6.0.3-next.227, <=8.0.0-canary.3460), @cedarjs/cli (>=6.0.3-next.227, <=8.0.0-canary.3460) +10 more potentially affected by unknown CVE via react-server-dom-webpack (19.3.0)

react-server-dom-webpack NPM version 19.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on react-server-dom-webpack and may be impacted: - @cedarjs/api-server-watch =6.0.3-next.227, =6.0.3-next.227, =6.0.3-next.227, =6.0.3-next.227, =6.0.3-next.227,...

@cedarjs/api-server-watch (>=6.0.3-next.227, <=8.0.0-canary.3460), @cedarjs/cli (>=6.0.3-next.227, <=8.0.0-canary.3460) +10 more potentially affected by unknown CVE via react-server-dom-webpack (19.3.0)

react-server-dom-webpack NPM version 19.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on react-server-dom-webpack and may be impacted: - @cedarjs/api-server-watch =6.0.3-next.227, =6.0.3-next.227, =6.0.3-next.227, =6.0.3-next.227, =6.0.3-next.227,...

VulnCheck KEV: CVE-2026-3279

The Enable jQuery Migrate Helper plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the downgradejqueryversion function in all versions up to, and including, 1.4.1. This is due to the function only verifying a nonce without checking user...