62942 matches found
CVE-2026-58179
creationtimestamp| type| source ---|---|--- 2026-07-29 11:28:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrrszuuitx2z 2026-07-30 09:22:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mru4hhitrt2s 2026-07-30 16:34:03+00:00| seen|...
CVE-2026-59243
The FAB auth manager's Azure AD OAuth login defaulted verifysignature=False when decoding the ID token, so an attacker able to present a forged or unsigned alg:none ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role...
CVE-2026-14488 Meta Box AIO <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'rwmb_frontend_field_object_id' Parameter
The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the templateredirect dispatcher in the MB Frontend Submission extension in versions up to, and including, 3.8.0. This is due to the handlerequest function routing the mbfsdelete action without any capability or...
CVE-2026-14488
CVE-2026-14488 affects the Meta Box AIO WordPress plugin (MB Frontend Submission extension) up to version 3.8.0. The vulnerability stems from handle_request() routing the mbfs_delete action without capability/ownership checks, and nonce verification in check_ajax() being gated behind is_ajax(), w...
CVE-2026-59243 Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`)
The FAB auth manager's Azure AD OAuth login defaulted verifysignature=False when decoding the ID token, so an attacker able to present a forged or unsigned alg:none ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role...
MINI-9F2R-QC58-4J2V
Bulletin has no description...
GHSA-6WCC-39RP-HH9P
creationtimestamp| type| source ---|---|--- 2026-07-29 04:31:03+00:00| seen| https://gist.github.com/alon710/58765246c17b37995ac42b87551c99f8...
CVE-2026-17166
creationtimestamp| type| source ---|---|--- 2026-07-29 03:29:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrqycuahes2q...
GHSA-9CRQ-QH8V-6XMM vulnerabilities
Vulnerabilities for packages: eco-python-curl...
CVE-2026-11564 vulnerabilities
Vulnerabilities for packages: eco-python-curl...
ECHO-08E8-B5D5-DBA7
Bulletin has no description...
CVE-2025-67406
https://www.sourcecodester.com Advocate office management system 1.0 is affected by: SQL Injection. The impact is: execute arbitrary code remote. The component is: control/activatecase.php,?id=1. The attack vector is: A SQL Injection vulnerability exists in the activatecase.php in parameter id...
CVE-2025-67406
https://www.sourcecodester.com Advocate office management system 1.0 is affected by: SQL Injection. The impact is: execute arbitrary code remote. The component is: control/activatecase.php,?id=1. The attack vector is: A SQL Injection vulnerability exists in the activatecase.php in parameter id...
PT-2026-65811
nanoid Nano ID before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that...
CVE-2026-67431: Improper Access Control
MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not bind a session ID to a session owner, allowing an attacker with a stolen session ID to send tools/call requests that...
CVE-2025-67406: Improper Neutralization of Special Elements used in an SQL Command
https://www.sourcecodester.com Advocate office management system 1.0 is affected by: SQL Injection. The impact is: execute arbitrary code remote. The component is: control/activatecase.php,?id=1. The attack vector is: A SQL Injection vulnerability exists in the activatecase.php in parameter id...
PT-2026-65913
kishan0725 Hospital Management System 4.0 is vulnerale to SQL Injection in get doctor.php via the parameters doctor and specilizationid...
VulnCheck KEV: CVE-2026-65884
Joomla Extension - balbooa.com - Privilege Escalation in Gridbox 2.20.2 - The registration method allows users provided usergroup IDs, allowing unauthenticated actors to register new accounts with administrative permissions...
CVE-2026-67213: Loop with Unreachable Exit Condition
nanoid Nano ID before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that...
PT-2026-65903
Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In 6.0.0 and earlier, the redfish- plugins built request URLs by concatenating an operator-supplied base URL with response-supplied @odata.id links, allowing a malicious or...