GHSA-7PGQ-CR25-XVC8 Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure

Summary Grav CMS's blueprint dynamic-field callable guard can be bypassed with a fully-qualified Class::method string, letting an account with only page-editing rights admin.pages, not super-admin plant a directive in a page's form-field frontmatter that invokes an arbitrary public static PHP...

CVE-2026-54676

Scoold , a Q&A and knowledge-sharing platform for teams, is affected by an authorization bypass in ApiController.getPostReplies() (file ApiController.java). Prior to 1.69.0 , the GET /api/posts/{id}/answers endpoint did not call canAccessSpace before returning reply data, allowing users holding a...

CVE-2026-54676 Scoold: GET /api/posts/{id}/answers leaks private-space replies when personal API tokens are enabled

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, users with personal API tokens can retrieve replies from questions in private spaces they cannot access because src/main/java/com/erudika/scoold/api/ApiController.java in ApiController.getPostReplies does not apply...

CVE-2026-54676 Scoold: GET /api/posts/{id}/answers leaks private-space replies when personal API tokens are enabled

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, users with personal API tokens can retrieve replies from questions in private spaces they cannot access because src/main/java/com/erudika/scoold/api/ApiController.java in ApiController.getPostReplies does not apply...

CVE-2026-54676 Scoold: GET /api/posts/{id}/answers leaks private-space replies when personal API tokens are enabled

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, users with personal API tokens can retrieve replies from questions in private spaces they cannot access because src/main/java/com/erudika/scoold/api/ApiController.java in ApiController.getPostReplies does not apply...

CVE_2025_68413-4

CVE202568413-4 Disclosure and PoCs for CVE-2025-68413 and CVE-2025-68414...

CVE-2026-54677

Scoold is a team Q&A and knowledge-sharing platform. Prior to 1.69.0 , the QuestionController.reply() and CommentController.createAjax() methods failed to apply the canAccessSpace authorization check used by the question read path. When scoold.is_default_space_public is set to false and private s...

CVE-2026-54551 WireGuard Portal: Authenticated WebSocket /api/v0/ws broadcasts all peers' and interfaces' traffic stats to every user (missing per-user authorization)

WireGuard Portal, or wg-portal, is a web-based configuration portal for WireGuard server management. From 2.2.0 until 2.3.0, the authenticated GET /api/v0/ws statistics WebSocket in internal/app/api/v0/handlers/endpointwebsocket.go subscribes to TopicPeerStatsUpdated and TopicInterfaceStatsUpdate...

CVE-2026-54551 WireGuard Portal: Authenticated WebSocket /api/v0/ws broadcasts all peers' and interfaces' traffic stats to every user (missing per-user authorization)

WireGuard Portal, or wg-portal, is a web-based configuration portal for WireGuard server management. From 2.2.0 until 2.3.0, the authenticated GET /api/v0/ws statistics WebSocket in internal/app/api/v0/handlers/endpointwebsocket.go subscribes to TopicPeerStatsUpdated and TopicInterfaceStatsUpdate...

CVE-2026-54551

WireGuard Portal (wg-portal) is a web-based configuration portal for managing WireGuard servers. In versions 2.2.0 through 2.3.0 , the authenticated /api/v0/ws statistics WebSocket (implemented in endpoint_websocket.go) subscribes to peer and interface stats topics and forwards every TrafficDelta...

EUVD-2026-82334

WireGuard Portal, or wg-portal, is a web-based configuration portal for WireGuard server management. From 2.2.0 until 2.3.0, the authenticated GET /api/v0/ws statistics WebSocket in internal/app/api/v0/handlers/endpointwebsocket.go subscribes to TopicPeerStatsUpdated and TopicInterfaceStatsUpdate...

CVE-2026-54551 WireGuard Portal: Authenticated WebSocket /api/v0/ws broadcasts all peers' and interfaces' traffic stats to every user (missing per-user authorization)

WireGuard Portal, or wg-portal, is a web-based configuration portal for WireGuard server management. From 2.2.0 until 2.3.0, the authenticated GET /api/v0/ws statistics WebSocket in internal/app/api/v0/handlers/endpointwebsocket.go subscribes to TopicPeerStatsUpdated and TopicInterfaceStatsUpdate...

GHSA-27GV-RFVV-22MV RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields

Summary An information disclosure vulnerability exists in the AMQP client implementation's authentication handling configuration. Following a successful connection handshake, the Connection.Config.SASL field stores the Authentication implementation state used to establish the session. For standar...

CVE-2026-92070

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure in the Networking component...

CVE-2026-92044

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure in the Networking: HTTP component...

Zope AccessControl vulnerable to information disclosure through Python string `format` and `format_map` functions

Impact Python's string format functionality allows someone controlling the format string to "read" objects accessible recursively via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown getattr and getitem, not the policy...

EUVD-2026-80790

Zope AccessControl vulnerable to information disclosure through Python string format and formatmap functions...

GHSA-PQ59-9FQ7-M886 Zope AccessControl vulnerable to information disclosure through Python string `format` and `format_map` functions

Impact Python's string format functionality allows someone controlling the format string to "read" objects accessible recursively via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown getattr and getitem, not the policy...

GHSA-WXMM-Q36W-R9XJ MariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requests

Summary MariaDB Connector/J does not enforce allowLocalInfile=false when processing server-initiated LOCAL INFILE requests protocol packet type 0xfb. However, exploitation is constrained: the server can only request the exact filename the client already included in its LOAD DATA LOCAL INFILE quer...

GHSA-WR57-HQMP-FGVH Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion

The Content Delivery API enforces member / Public Access protection only at the controller layer, against the node that is directly requested. When a public unprotected node references a protected node through a Content Picker or Multi-Node Tree Picker including those nested inside Block List,...