67611 matches found
CVE-2026-44787
Discourse exposes a flaw in signup: before versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a new user could set primary_group_id and gain whisper-group privileges when whispers_allowed_groups is configured. This is fixed in 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5. The CVSS 3.1 base score ...
CVE-2026-44787 Discourse: Signup-time primary_group_id assignment grants whisperer access
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the signup flow could allow newly registered users to set primarygroupid and gain whisper-group privileges without legitimate group membership on sites with whispersallowedgroups configured. This...
CVE-2026-44787
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the signup flow could allow newly registered users to set primarygroupid and gain whisper-group privileges without legitimate group membership on sites with whispersallowedgroups configured. This...
CVE-2026-52777
creationtimestamp| type| source ---|---|--- 2026-07-09 21:48:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqame5dcxj25 2026-07-09 22:35:05+00:00| published-proof-of-concept| https://github.com/YesWiki/yeswiki/security/advisories/GHSA-9369-69wj-7m2f 2026-09-05 02:07:17+00:0...
CVE-2026-55604
DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version 1.7.0, the process-global SessionStore accepts caller-supplied sessionid values without binding them to any authenticated principal or transport session. An attacker can enumerate active session I...
SQL Injection
Overview Affected versions of this package are vulnerable to SQL Injection via the deleteUserReaction process. An attacker can access and manipulate sensitive database information by injecting crafted SQL through the idreaction and id URL path parameters as an authenticated user. Remediation...
YesWiki Vulnerable to Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes
Summary YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using striptags only. Because striptags does not escape double quotes, an attacker can break out of the attribute value, inject an event handler such as onmouseover, and execute arbitrary JavaScript in the...
GHSA-R5XW-GCGW-HWP5 YesWiki Vulnerable to Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes
Summary YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using striptags only. Because striptags does not escape double quotes, an attacker can break out of the attribute value, inject an event handler such as onmouseover, and execute arbitrary JavaScript in the...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via improper handling of the id parameter in the Bazar widget handler. An attacker can execute arbitrary JavaScript in the victim's browser by crafting a malicious URL that injects attacker-controlled attributes...
GHSA-V4HW-Q98X-8JMM vulnerabilities
Vulnerabilities for packages: linux-azure, linux-gcp, linux-qemu-melange, linux-qemu...
GHSA-C53H-XMGP-J2HJ vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-P24M-96HG-M8M8 vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-8QP8-73PF-8G22 vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-J4R2-33QC-JRRJ vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-F2VR-9QRM-HV28 vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2026-14146 vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-499R-FH8Q-QCFC vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-3X3P-QX4R-HMGH vulnerabilities
Vulnerabilities for packages: chromium...
