CVE-2026-53947

Ghost is a Node.js content management system. From 5.18.0 until 6.21.1, a discrepancy in responses from the members signin endpoints made it possible for an unauthenticated attacker to determine whether a given email address belongs to a registered member of a Ghost site. This vulnerability is...

Information Exposure

Overview ghost is a publishing platform Affected versions of this package are vulnerable to Information Exposure via the members signin process. An attacker can enumerate registered email addresses by analyzing the differences in responses from the authentication endpoint. Remediation Upgrade gho...

EUVD-2026-38999

Missing Authentication for Critical Function CWE-306 in the RegisterView apps/accounts/views.py, exposed at POST /api/auth/register/, in MailerUp 1.0.1 allows a remote, unauthenticated attacker to self-register a working account on instances where registration is intended to be restricted, becaus...

CVE-2026-53947 Ghost: Member existence leak via magic link sign-in response

Ghost is a Node.js content management system. From 5.18.0 until 6.21.1, a discrepancy in responses from the members signin endpoints made it possible for an unauthenticated attacker to determine whether a given email address belongs to a registered member of a Ghost site. This vulnerability is...

CVE-2026-53947

Ghost is a Node.js content management system. From 5.18.0 until 6.21.1, a discrepancy in responses from the members signin endpoints made it possible for an unauthenticated attacker to determine whether a given email address belongs to a registered member of a Ghost site. This vulnerability is...

CVE-2026-13164

Missing Authentication for Critical Function CWE-306 in the RegisterView apps/accounts/views.py, exposed at POST /api/auth/register/, in MailerUp 1.0.1 allows a remote, unauthenticated attacker to self-register a working account on instances where registration is intended to be restricted, becaus...

CVE-2026-13164

Missing Authentication for Critical Function CWE-306 in the RegisterView apps/accounts/views.py, exposed at POST /api/auth/register/, in MailerUp 1.0.1 allows a remote, unauthenticated attacker to self-register a working account on instances where registration is intended to be restricted, becaus...

io.jenkins.plugins:zohosprints (>=1.0, <=1.1.4), org.jenkins-ci.plugins:build-name-setter (2.0.4) +6 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1.54)

org.jenkins-ci.plugins:script-security MAVEN version 1.54 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - io.jenkins.plugins:zohosprints =1.0, =2.4, =2.62.1, =2.2, =1.78, =2.0.0, =1.14,...

io.jenkins.plugins:zohosprints (>=1.0, <=1.1.4), org.jenkins-ci.plugins:build-name-setter (2.0.4) +6 more potentially affected by CVE-2026-57280 via org.jenkins-ci.plugins:script-security (1.54)

org.jenkins-ci.plugins:script-security MAVEN version 1.54 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - io.jenkins.plugins:zohosprints =1.0, =2.4, =2.62.1, =2.2, =1.78, =2.0.0, =1.14,...

org.jenkins-ci.plugins.workflow:workflow-aggregator (>=0.1-beta-5, <=0.1-beta-7), org.jenkins-ci.plugins.workflow:workflow-cps (>=0.1-beta-5, <=0.1-beta-7) +4 more potentially affected by CVE-2026-57280 via org.jenkins-ci.plugins:script-security (1.6)

org.jenkins-ci.plugins:script-security MAVEN version 1.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregator =0.1-beta-5, =0.1-beta-5,...

org.jenkins-ci.plugins.workflow:workflow-cps (>=3990.vd281dd77a_388, <=3993.v3e20a_37282f8), org.jenkins-ci.plugins:badge (>=2.4, <=2.5) +2 more potentially affected by CVE-2026-57280 via org.jenkins-ci.plugins:script-security (1367.vdf2fc45f229c)

org.jenkins-ci.plugins:script-security MAVEN version 1367.vdf2fc45f229c is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-cps =3990.vd281dd77a388, =2.4...

org.jenkins-ci.plugins.workflow:workflow-aggregator (>=0.1-beta-5, <=0.1-beta-7), org.jenkins-ci.plugins.workflow:workflow-cps (>=0.1-beta-5, <=0.1-beta-7) +4 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1.6)

org.jenkins-ci.plugins:script-security MAVEN version 1.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregator =0.1-beta-5, =0.1-beta-5,...

org.jenkins-ci.plugins.workflow:workflow-cps (>=3990.vd281dd77a_388, <=3993.v3e20a_37282f8), org.jenkins-ci.plugins:badge (>=2.4, <=2.5) +2 more potentially affected by CVE-2026-57281 via org.jenkins-ci.plugins:script-security (1367.vdf2fc45f229c)

org.jenkins-ci.plugins:script-security MAVEN version 1367.vdf2fc45f229c is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-cps =3990.vd281dd77a388, =2.4...

Astra Linux – Vulnerability in Python 3.11

The email module, specifically the “BytesGenerator” class, did not properly quote newlines for email headers when serializing an email message. This issue occurs only when using “LiteralHeader” to write headers that do not follow email folding rules. The new behavior will reject incorrectly folde...

Astra Linux – Vulnerability in Firefox, Thunderbird

Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9...

Watch out for renewal scams pretending to be Malwarebytes

Fake subscription renewal notices are doing the rounds again. Some of these scams impersonate Malwarebytes, and we've also seen them reach our customers. You're more likely to trust the message if you're already a customer of the company mentioned in the email. That's what the scammers are counti...

WordPress Email JavaScript Cloak plugin <= 1.03 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin Email JavaScript Cloak versions = 1.03...

CVE-2026-56338 Capgo - Denial of Service in 2FA Email Verification via /auth/v1/otp Endpoint

Capgo before 12.128.2 contains a denial of service vulnerability in the /auth/v1/otp endpoint that prevents email verification for two-factor authentication due to captcha validation failures. Authenticated users cannot complete 2FA enrollment as the backend consistently returns HTTP 500 errors...

CVE-2026-56338 Capgo - Denial of Service in 2FA Email Verification via /auth/v1/otp Endpoint

Capgo before 12.128.2 contains a denial of service vulnerability in the /auth/v1/otp endpoint that prevents email verification for two-factor authentication due to captcha validation failures. Authenticated users cannot complete 2FA enrollment as the backend consistently returns HTTP 500 errors...

CVE-2026-56310

Cap-go before 12.128.2 contains an authorization bypass vulnerability in the GET /organization/members endpoint that allows org-limited API keys to bypass limitedtoorgs restrictions. Attackers with org-limited API keys can read membership data including uid, email, imageurl, role, and istmp from...