Decidim - Private exports can be downloaded through reusable links

Description The normal downloadyourdata flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without authentication by anyone who obtains it. Impact Personal data exports can be retrieved through leakage channels such ...

CVE-2026-15510

creationtimestamp| type| source ---|---|--- 2026-07-12 23:35:19+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqidqncgq226 2026-07-12 23:46:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqiefc2vp526 2026-07-13 03:15:05+00:00| seen|...

CVE-2026-15506

creationtimestamp| type| source ---|---|--- 2026-07-12 22:29:18+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqia2lm2hr26 2026-07-12 23:41:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqie4dn33n2w 2026-07-13 01:00:36+00:00| seen|...

CVE-2026-15501

creationtimestamp| type| source ---|---|--- 2026-07-12 13:27:01+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqhbqvz6lj2a 2026-07-12 13:33:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqhc3qfqzv24 2026-07-12 17:18:02+00:00| seen|...

CVE-2026-56313

creationtimestamp| type| source ---|---|--- 2026-07-12 12:30:18+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqh6liqhun2y 2026-07-12 13:01:11+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqhacp5ihg2w 2026-07-12 13:02:28+00:00| seen|...

CVE-2026-15489

creationtimestamp| type| source ---|---|--- 2026-07-12 09:30:05+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqgujahjm22y 2026-07-12 11:42:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqh3wvvacr24...

CVE-2026-15474

creationtimestamp| type| source ---|---|--- 2026-07-12 03:32:17+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqgajgvj5q2w 2026-07-12 03:37:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqgasx3ayb2e...

CVE-2026-61448

creationtimestamp| type| source ---|---|--- 2026-07-11 14:37:42+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqevafnkle2e 2026-07-11 15:28:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqey2ecj722e 2026-07-11 17:07:04+00:00| seen|...

CVE-2026-15010

creationtimestamp| type| source ---|---|--- 2026-07-11 07:37:19+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqe5qoz5cx22 2026-07-11 07:37:19+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mqe5qog3a22o 2026-07-11 08:07:12+00:00| seen|...

CVE-2026-12738

creationtimestamp| type| source ---|---|--- 2026-07-11 07:32:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqe5ibgnnh27 2026-07-11 07:34:50+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqe5madgpn2e...

CVE-2026-13116

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.14.0 via the generatedocumentshortcode due to missing validation on a user controlled key. This makes it possible for authenticated...

CVE-2026-15338

creationtimestamp| type| source ---|---|--- 2026-07-11 04:42:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdtxhnb7y2y 2026-07-11 05:00:48+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqduyrtsfv2k 2026-07-13 00:00:20+00:00| seen|...

CVE-2026-13353

creationtimestamp| type| source ---|---|--- 2026-07-11 04:40:38+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdtuqz2qt27 2026-07-11 05:00:55+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqduyyvv3g25 2026-07-11 06:37:34+00:00| seen|...

EUVD-2026-43138

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.14.0 via the generatedocumentshortcode due to missing validation on a user controlled key. This makes it possible for authenticated...

CVE-2026-15080

creationtimestamp| type| source ---|---|--- 2026-07-11 03:15:47+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdp4z5ww52s 2026-07-11 03:15:47+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mqdp4z55v62o...

linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability

A flaw was found in linkify-it, a library for recognizing links with full Unicode support. The LinkifyIt.prototype.match function, the package's primary public API, has an algorithmic complexity of ON² for inputs containing many fuzzy links or emails. This can be exploited by a remote attacker...

CVE-2026-15301

creationtimestamp| type| source ---|---|--- 2026-07-11 00:55:52+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdhctfuzp2c 2026-07-11 00:55:53+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mqdhcuf6pi2k...

CVE-2026-15374

creationtimestamp| type| source ---|---|--- 2026-07-10 22:10:08+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd62hzrn727 2026-07-10 22:38:28+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd7n572pl2x 2026-07-11 00:15:42+00:00| seen|...

CVE-2026-11992

creationtimestamp| type| source ---|---|--- 2026-07-10 21:05:54+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd2hn2jul2d 2026-07-10 21:05:55+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mqd2ho65xv2o...

CVE-2026-55665 DOM-based XSS in Grist via unsanitized links, enabling privilege escalation

Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, Grist contained two cross-site scripting vulnerabilities where an attacker-controlled value reached a link's href without scheme validation, so a javascript URL could run in a victim's Grist origin on a single...