262000 matches found
CVE-2026-44342
New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 0.12.0-alpha.1, the email and WeChat account binding endpoints GET /api/oauth/email/bind and GET /api/oauth/wechat/bind used GET requests for state-changing account operations, allowing a...
CVE-2026-55424
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a topic "featured link" was not sufficiently normalized and escaped before being rendered in the topic list, allowing a user who can set a featured link to inject JavaScript when default Content...
CVE-2026-49256 Discourse: Hidden tag names leaked via category serializers
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, restricted tag and tag-group names attached to publicly readable categories as allowedtags, allowedtaggroups, or required tag groups could leak to anonymous and unauthorized users through categor...
CVE-2026-46413 Discourse: Regular users can route multipart uploads into the admin backup store
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, regular users could route direct S3 multipart uploads through ExternalUploadManager into the admin backup store. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5...
CVE-2026-57030 Junos OS: SRX Series: Flow sessions are not getting cleared leading to a DoS
A Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in the packet forwarding engine PFE of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service DoS. As part of the stateful...
CVE-2026-57030
A Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in the packet forwarding engine PFE of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service DoS. As part of the stateful...
CVE-2026-55170 OpenFGA MySQL backend: case-insensitive collation on identifier columns causes incorrect authorization decisions
OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, when MySQL is being used as the datastore and authorization decisions rely on case-sensitive user strings, the tuple, changelog, and authorizationmodel identifier columns can compare case-distinct values such as...
WordPress KiviCare – Clinic & Patient Management System (EHR) plugin <= 4.4.0 - Missing Authorization to Unauthenticated Payment Bypass and Appointment Status Manipulation vulnerability
Missing Authorization to Unauthenticated Payment Bypass and Appointment Status Manipulation vulnerability discovered by Niv Kochan in WordPress Plugin KiviCare versions = 4.4.0...
GHSA-QMJ7-FH92-4787 vulnerabilities
Vulnerabilities for packages: linux-azure, linux-qemu-melange, linux-qemu, linux-gcp...
GHSA-X5G3-HX3C-GFXX vulnerabilities
Vulnerabilities for packages: linux-azure, linux-qemu-melange, linux-qemu, linux-gcp...
GHSA-R42M-J2MW-2QF9 vulnerabilities
Vulnerabilities for packages: linux-azure, linux-qemu-melange, linux-qemu, linux-gcp...
CVE-2026-53148 vulnerabilities
Vulnerabilities for packages: linux-azure, linux-qemu-melange, linux-qemu, linux-gcp...
GHSA-G4XJ-VXVQ-MQXR vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-J39G-274J-3WPM vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-JQ2W-R287-VQVJ vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-F4QH-GR9M-2CMM vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-H4V8-PH46-3VQP vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-PG56-9PGF-WM9X vulnerabilities
Vulnerabilities for packages: chromium...