CVE-2026-45115

MyBB's Buddy/Ignore component fails to escape single quotes in usernames via htmlspecialchars_uni(), enabling stored XSS in the User CP and Private Messages Select Buddies list. Victims are affected when confirming buddy removal in usercp.php or selecting buddies in the xmlhttp.php onclick handle...

CVE-2026-45115 MyBB: Buddy/ignore list username XSS

MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform JavaScript code injection through a specially crafted username. The User CP Buddy/Ignore list and the Select Buddies list in Private Messag...

EUVD-2026-61005

MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform JavaScript code injection through a specially crafted username. The User CP Buddy/Ignore list and the Select Buddies list in Private Messag...

CVE-2026-45115 MyBB: Buddy/ignore list username XSS

MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform JavaScript code injection through a specially crafted username. The User CP Buddy/Ignore list and the Select Buddies list in Private Messag...

CVE-2026-69189

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while...

EUVD-2026-60952

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while...

CVE-2026-69189

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while...

GO-2026-6148 Apache Answer has an Exposure of Private Personal Information to an Unauthorized Actor vulnerability in github.com/apache/answer

Apache Answer has an Exposure of Private Personal Information to an Unauthorized Actor vulnerability in github.com/apache/answer...

CVE-2026-73692

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-73692

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

EUVD-2026-60764

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-73692

This CVE ID has been rejected by its CVE Numbering Authority. The underlying vulnerability, tracked as PT-2026-77030 , affects Dolibarr and involves an authorization bypass in the clonetasks mass action . The root cause is an inverted boolean condition in the private-project membership check with...

CVE-2026-73692

...

BIT-GITLAB-2026-6821 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to bypass IP-based access restrictions and read limited merge request information from a...

WordPress ECS plugin < 4.3.8 - Unauthenticated Private Content Disclosure via ecsload vulnerability

Unauthenticated Private Content Disclosure via ecsload vulnerability discovered by Jashid Sany in WordPress Plugin ECS – Ele Custom Skin for Elementor versions 4.3.8...

ANT-2026-1BCAFJCC · torvalds/linux · Use-After-Free

use-after-free high CVE-2026-31554 Severity Claude high · Security research firm - · Maintainer high REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-1BCAFJCC: futex: UAF in private-hash teardown via cross-process sysfutexrequeue leading giving LPE A process P can allocat...

EUVD-2026-60542

Mattermost versions 10.11.x = 10.11.20, 11.7.x = 11.7.5 Mattermost fails to remove thread membership records when a user is removed from or leaves a team, which allows a previously removed user who is later re-invited to the team to view private channel thread root post content and metadata via t...

EUVD-2026-60550

An issue in Trueview T18061 WiFi 3MP Robot Pan-Tilt Security Camera Version 1.0 allows a physically proximate attacker to escalate privileges via the RSA private key component...

PT-2026-77316

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio terminal SSH key authentication in custom components/blueprint studio/backend/terminal manager.py wrote SSH private-key material to a file under the Home Assistant configuration...

PT-2026-77146

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while...