24432 matches found
CVE-2026-55472
creationtimestamp| type| source ---|---|--- 2026-07-10 20:10:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqcxdteayy2z 2026-07-11 01:02:46+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdhp6pnjy2y 2026-07-14 04:11:02+00:00| seen|...
SiYuan: Stored XSS in Bazaar marketplace via package README event handlers
Summary renderPackageREADME in kernel/bazaar/readme.go renders a Bazaar package README from Markdown to HTML with the lute engine and SetSanitizetrue. The lute sanitizer is an event-handler blocklist: allowAttr rejects only attribute names present in a fixed eventAttrs map copied from the w3schoo...
GHSA-W7CG-WHH7-XP28 SiYuan: Stored XSS in Bazaar marketplace via package README event handlers
Summary renderPackageREADME in kernel/bazaar/readme.go renders a Bazaar package README from Markdown to HTML with the lute engine and SetSanitizetrue. The lute sanitizer is an event-handler blocklist: allowAttr rejects only attribute names present in a fixed eventAttrs map copied from the w3schoo...
CVE-2026-55670 ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers
ZITADEL is an open source identity management platform. Prior to 4.15.1, ZITADEL's event store validation can retain the original resource owner for a deleted user identifier, causing a later user recreated with the same identifier in another organization to be provisioned under the original...
CVE-2026-55670 ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers
ZITADEL is an open source identity management platform. Prior to 4.15.1, ZITADEL's event store validation can retain the original resource owner for a deleted user identifier, causing a later user recreated with the same identifier in another organization to be provisioned under the original...
EUVD-2026-42977
ZITADEL is an open source identity management platform. Prior to 4.15.1, ZITADEL's event store validation can retain the original resource owner for a deleted user identifier, causing a later user recreated with the same identifier in another organization to be provisioned under the original...
CVE-2026-55670
ZITADEL (open source identity management) prior to v4.15.2 is affected by a cross-tenant leakage in the event store validation: when a user is deleted, the original resource owner may remain associated with the deleted user’s ID and, if a new user is recreated in another organization with the sam...
CVE-2026-55670 ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers
ZITADEL is an open source identity management platform. Prior to 4.15.1, ZITADEL's event store validation can retain the original resource owner for a deleted user identifier, causing a later user recreated with the same identifier in another organization to be provisioned under the original...
CVE-2026-33382
creationtimestamp| type| source ---|---|--- 2026-07-10 17:00:54+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqcmrjabny2r 2026-07-10 22:29:42+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd75hwwav2i 2026-07-11 00:20:09+00:00| seen|...
CVE-2026-60086
creationtimestamp| type| source ---|---|--- 2026-07-10 16:24:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqckqcwydo2z 2026-07-10 20:23:11+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcy3aa7mh22...
GHSA-CWC9-CP4J-MCVV libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays
Summary gossipsub processes IHAVE and IWANT control messages by iterating every received message ID synchronously before doing anything with the results. There is no cap on how many IDs a single frame may contain. The default LP frame limit is 4MB, which fits roughly 180,000 message IDs. Iteratin...
EUVD-2026-42409
libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays...
CVE-2026-15298
creationtimestamp| type| source ---|---|--- 2026-07-10 14:10:12+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mqcdablfyd2v...
CVE-2026-12955
creationtimestamp| type| source ---|---|--- 2026-07-10 12:13:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqc4oz4s4a2i 2026-07-10 21:13:54+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd2vwd6tv2s...
CVE-2026-13010
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via 'event' Shortcode Attribute in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2026-13010
The CVE-2026-13010 entry concerns the JoomSport plugin for WordPress (Team & League, Football, Hockey & more). Affected versions: all up to and including 5.7.9. Vulnerability type: time-based SQL Injection via the 'event' shortcode attribute, caused by insufficient escaping of the user-supplied p...
CVE-2026-13010 JoomSport <= 5.7.9 - Authenticated (Contributor+) SQL Injection via 'event' Shortcode Attribute
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via 'event' Shortcode Attribute in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2026-13010
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via 'event' Shortcode Attribute in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient...
EUVD-2026-42860
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via 'event' Shortcode Attribute in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient...