75294 matches found
CVE-2026-65912 DOMPurify before 3.3.2 URI Validation Bypass via ADD_ATTR
DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADDATTR is provided as a predicate function via EXTRAELEMENTHANDLING.attributeCheck. Attackers can supply a predicate that accepts specific attribute and tag combinations to bypass URI-safe validation, allowing unsafe...
CGA-3JGG-PXMX-5X66
Bulletin has no description...
CVE-2026-65455
creationtimestamp| type| source ---|---|--- 2026-07-23 13:10:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrcvwqelee2v...
CVE-2026-65897
Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create, allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership,...
CGA-8JWW-W856-PP8W
Bulletin has no description...
CVE-2026-64142
creationtimestamp| type| source ---|---|--- 2026-07-23 12:00:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrcrzkrruz2k 2026-10-01 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities20261002...
CVE-2026-60158
creationtimestamp| type| source ---|---|--- 2026-07-23 11:55:19+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrcrqzxkqk2j...
CVE-2026-60160
creationtimestamp| type| source ---|---|--- 2026-07-23 11:55:19+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrcrqzxkqk2j...
CVE-2026-60150
creationtimestamp| type| source ---|---|--- 2026-07-23 11:55:18+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrcrqzxkqk2j 2026-07-23 16:46:54+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...
CGA-7RR6-345F-3WPM
Bulletin has no description...
PYSEC-2026-3482 MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal
Summary In affected versions, the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the session identifier, without verifying that the request was authenticated as the same principal that created the session. Anyone who learned or guessed a...
MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal
SummaryIn affected versions, the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the session identifier, without verifying that the request was authenticated as the same principal that created the session. Anyone who learned or guessed a...
CVE-2026-64812
CVE-2026-64812 affects JetBrains IntelliJ IDEA prior to 2026.2. The vulnerability allows unauthorized input injection during a Remote Development session. Root cause details are not elaborated beyond the description; exploitation status and mitigation are not specified in the provided documents. ...
CVE-2026-64611
creationtimestamp| type| source ---|---|--- 2026-07-23 11:28:26+00:00| seen| https://bsky.app/profile/suriq.io/post/3mrcqaxjpvx2z 2026-07-27 16:00:06+00:00| seen| https://t.me/bdufstecru/3344 2026-07-28 00:00:31+00:00| published-proof-of-concept| https://t.me/bdufstecru/3344...
CVE-2026-65522 WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...
CVE-2026-65489
Unauthenticated Broken Access Control in LA-Studio Element Kit for Elementor = 1.6.2 versions...
MINI-8Q83-9WW4-HMC5
Bulletin has no description...
ECHO-D56E-2B48-3DD3
Bulletin has no description...
CVE-2026-16723
creationtimestamp| type| source ---|---|--- 2026-07-23 08:46:26+00:00| seen| https://bsky.app/profile/suriq.io/post/3mrch7ck5e62q 2026-07-23 09:00:28+00:00| seen| https://infosec.exchange/users/offseq/statuses/116968471131630189 2026-07-23 09:00:30+00:00| seen|...