261589 matches found
ROOT-APP-PYPI-CVE-2026-45134 CVE-2026-45134 in langsmith - Patched by Root
Root has patched CVE-2026-45134 in the langsmith package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-48775 CVE-2026-48775 in langgraph-checkpoint - Patched by Root
Root has patched CVE-2026-48775 in the langgraph-checkpoint package for Root:PyPI. Multiple fixed versions available...
CVE-2026-18901
creationtimestamp| type| source ---|---|--- 2026-08-05 08:53:50+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3msd5oiwmrl2g...
ROOT-APP-MAVEN-CVE-2026-50193 CVE-2026-50193 in com.fasterxml.jackson.core:jackson-databind - Patched by Root
Root has patched CVE-2026-50193 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...
GHSA-F7VP-7XGX-4W4R vulnerabilities
Vulnerabilities for packages: privatebin, nextcloud-server, drupal, moodle...
CVE-2026-71206
Shiori's CheckToken function internal/domains/auth.go validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocation mechanism exists in the codebase...
CVE-2026-12000
The Page and Post Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 1.4.0 via the WordPress core REST endpoints /wp-json/wp/v2/pages, /wp-json/wp/v2/pages/, /wp-json/wp/v2/posts, and /wp-json/wp/v2/posts/. This is due to the plugin's...
CVE-2026-64581
In the Linux kernel, the following vulnerability has been resolved: xfrm: fix skdstcache double-free in xfrmuserpolicy xfrmuserpolicy clears the socket dst cache with skdstreset, i.e. the non-atomic skdstsetsk, NULL: it reads skdstcache with rcudereferenceprotected, stores NULL and dstreleases th...
CVE-2026-64576
In the Linux kernel, the following vulnerability has been resolved: nexthop: initialize extack in nhresbucketmigrate nhresbucketmigrate passes an uninitialized netlinkextack to callnexthopresbucketnotifiers. When nhnotifierresbucketinfoinit fails e.g. the kzalloc returns -ENOMEM, the error is...
CLSA-2026-1785917160 TuxCare security update for org.codehaus.plexus:plexus-utils (1 CVE)
TuxCare rebuilt org.codehaus.plexus:plexus-utils to address 1 CVE. Fixed in 3.5.1-tuxcare.1...
CVE-2026-16561
The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX actions, allowing unauthenticated users to retrieve the comments of images belonging to private, password-protected or otherwise access-restricted galleries...
CVE-2026-71210 mealie - DNS-Rebinding TOCTOU in SSRF Guard Allows Internal Network and Cloud Metadata Access
Mealie's AsyncSafeTransport SSRF guard mealie/pkgs/safehttp/transport.py resolves a target hostname once, checks the resolved IP against private-range rules, but then issues the actual outbound HTTP request using the original hostname, which the underlying async transport re-resolves independentl...
CVE-2026-71205 changedetection.io - No Rate Limiting on /login Enables Unlimited Password Brute-Force
changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout no rate-limiting library is present in requirements.txt...
CVE-2026-71203 changedetection.io - Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema
changedetection.io's REST API resources are protected by an @auth.checktoken decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec changedetectionio/api/Spec.py, whose get method carries neither @auth.checktoken nor @validateopenapirequest...
CVE-2026-12000
The CVE-2026-12000 entry concerns the Page and Post Restriction plugin for WordPress (affected versions up to and including 1.4.0). The issue arises because REST guards (papr_restrict_page_post_rest_api and the the_posts filter via papr_filter_posts) derive the restricted-ID list only from per-pa...
CVE-2026-7105
CVE-2026-7105 affects the WordPress plugin Xpro Addons up to version 1.5.1. The root cause is a missing capability check in the get_menu_content_editor() function, allowing authenticated users with Subscriber+ privileges to create arbitrary published posts of the xpro_content CPT. The created pos...
CVE-2026-15210 Login/Signup with Phone Number, OTP Verification < 1.8.71 - Unauthenticated Account Takeover via OTP Brute Force
The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeri...
CVE-2026-16942 WP Custom HTML Pages <= 0.6.2 - Author+ Stored XSS
The WP Custom HTML Page WordPress plugin through 0.6.2 does not sanitise HTML stored through one of its custom page handlers, nor restrict it to users allowed to post unfiltered HTML, allowing users with the Author role to store JavaScript that is served unescaped at a public URL and executes for...
EUVD-2026-53105
The Passster WordPress plugin before 4.3.6 outputs password-protected block content in the public page response before verifying the password, allowing unauthenticated users to recover the protected content without knowing the password...