Cross-site Scripting (XSS)

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the ElementTableSorter.js process when a user with sufficient permissions drags an entry under a maliciously crafted entry in table view. An attacker can execute...

crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries

A flaw was found in the crypto/x509 package of golang. This vulnerability allows a remote attacker to cause a Denial of Service DoS by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name SAN entries. The certificate verification process, specifical...

PT-2026-56068

Name of the Vulnerable Software and Affected Versions Coder versions 2.17.0 through 2.29.6 Coder versions 2.32.0 through 2.32.6 Coder versions 2.33.0 through 2.33.7 Coder versions 2.34.0 through 2.34.1 Description The POST /api/v2/files endpoint converts zip uploads to tar in memory using the...

Improper Authorization

Craft CMS is vulnerable to Improper Authorization. The vulnerability is due to insufficient permission checks when moving entries between sections, where only view permission is validated for the destination section instead of save permission, allowing low-privileged users to move entries into...

CVE-2026-53359

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad "KVM: x86: Fix shadow paging use-after-free due to unexpected GFN" fixed a shadow paging mismatch between stored and computed GFNs; the bug...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the tracked-time deletion process. An attacker can remove time tracking entries associated with issues they do not have permission to modify by specifying the time entry ID from anothe...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the tracked-time deletion process. An attacker can remove time tracking entries associated with issues they do not have permission to modify by specifying the time entry ID from anothe...

Gitea exposes tracked time entries without repository authorization

Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries...

GHSA-FHQ3-P242-2QPF Gitea exposes tracked time entries without repository authorization

Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries...

CVE-2026-25782

Gitea versions before 1.25.5 look up tracked-time entries by time ID without scoping the lookup to the issue in the request URL, allowing deletion attempts to target entries from another issue...

CVE-2026-25782

Gitea versions before 1.25.5 are vulnerable to an authorization bypass during the tracked-time deletion process. The root cause is that the application looks up tracked-time entries by time ID without scoping the lookup to the specific issue provided in the request URL. This allows an attacker to...

EUVD-2026-41626

Gitea versions before 1.25.5 look up tracked-time entries by time ID without scoping the lookup to the issue in the request URL, allowing deletion attempts to target entries from another issue...

EUVD-2026-41615

Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries...

CVE-2026-20909

Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries...

SUSE CVE-2026-53333

In the Linux kernel, the following vulnerability has been resolved: mm/mincore: handle non-swap entries before !CONFIGSWAP guard mincoreswap also fields migration/hwpoison entries and shmem swapin-error entries, which can exist on !CONFIGSWAP builds when CONFIGMIGRATION or CONFIGMEMORYFAILURE is...

SUSE CVE-2026-53336

In the Linux kernel, the following vulnerability has been resolved: nvmem: layouts: onie-tlv: fix hang on unknown types The EEPROM on my board has a vendor specific entry of type 0x41. When stumbling upon that, this driver hangs in an endless loop. Fix it by keep incrementing the offset on unknow...

PT-2026-55588

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.25.5 Description Insufficient permission checks occur when listing tracked time entries. Recommendations Update to version 1.25.5 or later...

CVE-2026-12557: Missing Authorization

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.3.29. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read all...

CVE-2026-20909: Improper Access Control

Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries...

@conform-to/dom parseSubmission vulnerable to CPU exhaustion when parsing many unique form fields

A CPU exhaustion vulnerability exists in Conform's parseSubmission future API when parsing FormData or URLSearchParams submissions with many unique field names. The parser previously looked up values by field name, which could require repeated scans of the submitted entries and cause excessive...