CVE-2026-54464 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, commercial-gitlab-rails-ee-fips, gitlab-rails-ce-fips, commercial-gitlab-rails-ee...

GHSA-GHHP-3QVG-889P vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, commercial-gitlab-rails-ee-fips, gitlab-rails-ce-fips, commercial-gitlab-rails-ee...

CVE-2026-73419 NextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them

NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to the provider that created them. On callback, a check value...

GHSA-4846-7XWG-PW5M vulnerabilities

Vulnerabilities for packages: libssh...

GHSA-97FP-2VW9-Q5JG vulnerabilities

Vulnerabilities for packages: libssh...

GHSA-MQ2J-7VQ4-77M8 vulnerabilities

Vulnerabilities for packages: libssh...

GHSA-QP28-HPG5-J7XC vulnerabilities

Vulnerabilities for packages: libssh...

GHSA-X94W-CG8G-G593 vulnerabilities

Vulnerabilities for packages: libssh...

CVE-2026-59843 vulnerabilities

Vulnerabilities for packages: libssh...

CVE-2026-59851 vulnerabilities

Vulnerabilities for packages: libssh...

GHSA-CR6P-6527-344M vulnerabilities

Vulnerabilities for packages: libssh...

GHSA-X5CR-V39M-53GW vulnerabilities

Vulnerabilities for packages: libssh...

CVE-2026-59844 vulnerabilities

Vulnerabilities for packages: libssh...

CVE-2026-59842 vulnerabilities

Vulnerabilities for packages: libssh...

Insufficient OIDC endpoint validation could invoke unintended local protocol handlers

MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's discovery document. A user induced to connect to an uncontrolled MongoDB deployment using MONGODB-OIDC authentication may have an uncontrolled...

CVE-2026-73303

Budibase is an open-source low-code platform. Prior to 3.40.0, POST /api/v2/email on account.budibase.app accepted a client-controlled accountId without binding it to the authenticated session, while checking only currentEmail. An authenticated attacker who obtains a victim account identifier can...

CVE-2026-73306

Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the failure counter in packages/worker/src/api/controllers/global/auth.ts only for existing users, while packages/worker/src/middleware/emailLockout.ts returned X-Account-Locked and...

CVE-2026-72809

SiYuan versions = v3.7.2 patched in v3.7.4 contain an authentication bypass vulnerability in the kernel's CheckAuth function, which grants the administrator role RoleAdministrator to any request whose RemoteAddr is loopback 127.0.0.1 for a specific set of endpoints including /api/system/exit,...

CVE-2026-72806

SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the FilterViewByPublishAccess filter that fails to check publish password protection when rendering attribute views and database rows. Unauthenticated readers can access password-protected document rows including...

CVE-2026-72786

Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save action that allows authenticated users to change passwords without verification. Attackers with edit users permission can reset any user's password including administrators by exploiting the...