261989 matches found
CVE-2026-9586
creationtimestamp| type| source ---|---|--- 2026-07-17 18:16:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqueaetgtc24 2026-07-17 18:48:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqug2pd24u2g...
EUVD-2026-45242
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a low-privilege admin user with userrecovery:read ACL can take over any admin account by triggering POST /api/action/user/user-recovery, reading the password recovery hash through POST /api/search/user-recovery, and using PAT...
CVE-2026-12705
creationtimestamp| type| source ---|---|--- 2026-07-17 17:55:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqud3r4mxv2j 2026-07-28 16:51:30+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-07...
CVE-2026-48016 Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the Store API endpoint /store-api/handle-payment in src/Core/Checkout/Payment/SalesChannel/HandlePaymentMethodRoute.php accepts a user-controlled orderId and forwards it to src/Core/Checkout/Payment/PaymentProcessor.php witho...
CVE-2026-49208
Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, when a LiveProp is typed as DateTimeInterface and no explicit format is configured, Symfony\UX\LiveComponent\LiveComponentHydrator::hydrateObjectValue falls back to new $className$value, allowing client-supplied...
CVE-2026-16093
CVE-2026-16093 affects Keycloak’s Client Policies by allowing bypass of the requirement to use signed JWTs. A flaw lets an attacker with valid client credentials submit a fake, unsigned assertion header, making the system think policy requirements are met and enabling authentication with simpler ...
CVE-2026-49216
Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, the Stimulus controller in symfony/ux-autocomplete renders AJAX response items in createAutocompleteWithRemoteData by interpolating the text field into HTML template literals $itemlabelField rather than text,...
CVE-2026-47869
creationtimestamp| type| source ---|---|--- 2026-07-17 16:15:12+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/broadcom-vmware-security-advisory-av26-712 2026-07-18 10:01:31+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqvz2xjjh42f 2026-07-18 12:16:36+00:00| seen|...
CVE-2026-49208 Symfony UX: Format-less date LiveProps parsed with the permissive DateTime constructor
Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, when a LiveProp is typed as DateTimeInterface and no explicit format is configured, Symfony\UX\LiveComponent\LiveComponentHydrator::hydrateObjectValue falls back to new $className$value, allowing client-supplied...
CVE-2026-47867
creationtimestamp| type| source ---|---|--- 2026-07-17 16:03:47+00:00| seen| https://bsky.app/profile/cyfar.ca/post/3mqu4ttfbde2i 2026-07-17 16:15:23+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/broadcom-vmware-security-advisory-av26-712 2026-07-18 10:00:42+00:00| seen|...
CVE-2026-49212 Symfony UX: LiveComponentHydrator HMAC checksum lacks component and slot binding
Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, the HMAC computed by Symfony\UX\LiveComponent\LiveComponentHydrator covered only sorted prop key/value pairs and did not include the component name, the slot identifier props vs propsFromParent, or request contex...
CVE-2026-49209
Symfony UX is a JavaScript ecosystem for Symfony. From 2.5.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Controller\BatchActionController::invoke iterates over the client-supplied actions array and issues a full HttpKernel sub-request for each entry; because the array size is never bounded, ...
CVE-2026-9588
A stored cross-site scripting XSS vulnerability exists in Sangoma Switchvox SMB Edition 8.3 104997 within the voicemail notification template functionality. The submitmodifyvoicemailtemplate endpoint fails to properly sanitize HTML content supplied by authenticated users, allowing malicious...
EUVD-2026-45186
osTicket versions v1.18.3 and v1.17.7 contain a Broken Object Level Authorization BOLA leading to Insecure Direct Object Reference IDOR in the AJAX ticket-management subsystem...
GHSA-36HH-V3QG-5JQ4 vulnerabilities
Vulnerabilities for packages: py3-xet-core...
GHSA-6GFG-HH9C-WX87 vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2026-15778 vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2026-15777 vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2026-16017 mosaxiv clawlet cron Chat Tool tool_cron.go remove authorization
A security flaw has been discovered in mosaxiv clawlet up to 0.2.10. Impacted is the function list/remove of the file tools/toolcron.go of the component cron Chat Tool. The manipulation results in missing authorization. The attack may be performed from remote. The exploit has been released to the...