1406538 matches found
CVE-2026-48051
Papra (document management platform) prior to version 26.5.0 is vulnerable to SSRF via its webhook delivery system. The issue arises because the SSRF protection checks only the registered webhook URL and ignores redirects; the HTTP client (ofetch) automatically follows 3xx redirects, and the redi...
CVE-2026-64642
CVE-2026-64642 affects Next.js (16.0.0–16.2.10) where crafted requests to App Router apps built with Turbopack and a single locale entry in config.i18n.locales can bypass middleware or proxy authentication. Root cause: improper handling of authentication flow under specific App Router configurati...
CVE-2026-12394
creationtimestamp| type| source ---|---|--- 2026-07-27 17:10:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrnf7mmhgz24...
Qualys Expands Serverless Security with Vulnerability Scanning for AWS Lambda
Key Takeaways Qualys now delivers automated AWS Lambda vulnerability scanning , extending serverless security beyond posture checks CSPM into workload-level risk visibility. CSPM alone only catches misconfigurations excessive permissions, exposure, logging, encryption — it can't detect vulnerable...
CVE-2026-55953
The Erlang/OTP ssl TLS 1.2 and earlier and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tlshandshake:hello/5 handler validates the negotiated protocol version and the downgrade...
CVE-2026-52686
A flaw was found in pdns-recursor. This vulnerability allows a remote attacker to bypass DNSSEC Domain Name System Security Extensions validation. The flaw occurs because the system accepts wildcard expansion proofs NSEC/NSEC3 records without proper signature validation when the wildcard answer i...
EUVD-2026-49334
VeloCloud Orchestrator VCO on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by...
CVE-2026-13597
creationtimestamp| type| source ---|---|--- 2026-07-27 16:04:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrnbjklh6g24...
CVE-2026-59898
A flaw was found in netty-codec-http. The WebSocket handshaker in this component fails to properly validate protocol version information during the WebSocket upgrade process. A remote attacker can exploit this vulnerability by manipulating the WebSocket handshake, leading to a bypass of security...
CVE-2026-56821
A flaw was found in netty-handler-ssl-ocsp, a component of the Netty network application framework. The Online Certificate Status Protocol OCSP stapling validator in this component does not properly check certificate revocation status. This can allow an attacker to use revoked certificates withou...
EUVD-2026-49325
Allocation of resources without limits in Erlang/OTP publickey certificate path validation allows a remote unauthenticated attacker to cause denial of service by sending a crafted X.509 certificate chain during the TLS handshake. During RFC 5280 policy processing in publickey:pkixpathvalidation/3...
CVE-2026-56822
A flaw was found in Netty's netty-handler-ssl-ocsp component. This vulnerability involves a time-of-check/time-of-use TOCTOU race condition within the OCSP stapling validator. A remote attacker could exploit this timing window, allowing them to use a certificate that has been revoked for...
CVE-2026-55953 TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication
The Erlang/OTP ssl TLS 1.2 and earlier and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tlshandshake:hello/5 handler validates the negotiated protocol version and the downgrade...
CVE-2026-65564
Unauthenticated Sensitive Data Exposure in MapPress Maps for WordPress = 2.97.6 versions...
CVE-2026-10819
Mattermost versions 11.6.x = 11.6.5, 10.11.x = 10.11.20, 11.8.x = 11.8.1, 11.7.x = 11.7.4 fail to limit the number of frames and enforce the file size cap on animated GIF uploads, which allows an authenticated attacker to cause a denial of service via a crafted animated GIF uploaded as a custom...
CVE-2026-13332
creationtimestamp| type| source ---|---|--- 2026-07-27 15:04:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrn66bnwxn2u...
CVE-2026-58227 TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain
The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In sslcertificate:handleincompletechain/5, the received chain is passed to sslcertificate:buildcertificatechain/5, which walks issuer relationships via...
CVE-2026-10819
The CVE CVE-2026-10819 affects Mattermost server versions 11.6.x <= 11.6.5, 10.11.x <= 10.11.20, 11.8.x <= 11.8.1, and 11.7.x
EUVD-2026-49253
Mattermost versions 11.8.x = 11.8.0, 11.7.x = 11.7.3, 11.6.x = 11.6.5, 10.11.x = 10.11.20 fail to bound the time and resource consumption of server-side document content extraction which allows an authenticated user with file-upload permission to degrade file uploads for all users on the server v...
CVE-2026-66475 WordPress Checkout Field Editor for WooCommerce – Checkout Manager plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability
Shop manager Cross Site Scripting XSS in Checkout Field Editor for WooCommerce Checkout Manager = 3.0.5 versions...