CVE-2026-1937

🔴 Resumen de la Vulnerabilidad CVE-2026-1937 — Autorización faltante → Actualización arbitraria de opciones → Escalada de privilegios Campo| Detalles ---|--- ID CVE| CVE-2026-1937 Gravedad| ALTA — Puntuación CVSS v3.1: 7.2 Vector| CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CNA| Wordfence...

EUVD-2026-42475

Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard /browser endpoint...

CVE-2026-57177

A flaw was found in social-auth-core. The LoginRadius authentication backend fails to validate the state parameter during the authentication flow, resulting in a login Cross-Site Request Forgery CSRF vulnerability. A remote attacker could exploit this by tricking a user into completing...

CVE-2026-61604

The ixo Blockchain is a Layer 1 blockchain that runs on both Testnet and Mainnet. Prior to version 8.0.0, the x/bonds module moved funds from an address that was resolved from a DID verification method, without verifying that the resolved address belonged to the transaction signer. Affected...

CVE-2026-57177

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to...

DEBIAN-CVE-2026-57177

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to...

dual-ec-drbg

Backdoor DualECDRBG: Prueba de concepto educativa Para profesionales de la seguridad | Solo con fines educativos ⚠️ Descargo de responsabilidad Este repositorio contiene una demostración educativa de la puerta trasera criptográfica DualECDRBG CVE-2014-8610, una vulnerabilidad bien documentada...

copy.fail-mitigation-MLM

Crear un nuevo canal de configuración State Channel en Multi-Linux Manager usando el código del archivo copy-fail.sls. Asigna el canal de configuración a todas tus máquinas y ejecútalo, o ejecuta Highstate. ¡Esto es una solución temporal!...

CVE-2026-61604 ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass

The ixo Blockchain is a Layer 1 blockchain that runs on both Testnet and Mainnet. Prior to version 8.0.0, the x/bonds module moved funds from an address that was resolved from a DID verification method, without verifying that the resolved address belonged to the transaction signer. Affected...

CVE-2026-57177

The python-social-auth (social-auth-core) library is vulnerable to Login CSRF in versions prior to 5.0.0 due to a missing state parameter validation in the LoginRadius backend . An attacker can trick a victim's browser into completing an authentication flow using an attacker-controlled token, res...

EUVD-2026-86311

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to...

CVE-2026-57177 social-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backend

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to...

CVE-2026-57177 social-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backend

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to...

CVE-2026-57177

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to...

CVE-2026-97512

In the Linux kernel, the following vulnerability has been resolved: spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM The runtime PM functions had incomplete error handling that could leave the system in an inconsistent state. If any operation failed midway through suspend or resume...

AZL-103857 CVE-2026-97407 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ASoC: rockchip: rockchippdm: Handle runtime PM resume failures in setfmt rockchippdmsetfmt calls pmruntimegetsync before accessing hardware registers, but ignores its return value. If the runtime resume fails, the function...

DEBIAN-CVE-2026-97407

In the Linux kernel, the following vulnerability has been resolved: ASoC: rockchip: rockchippdm: Handle runtime PM resume failures in setfmt rockchippdmsetfmt calls pmruntimegetsync before accessing hardware registers, but ignores its return value. If the runtime resume fails, the function...

kernel: Linux kernel: Denial of Service in libceph OSD client due to unreset sparse-read state

A flaw was found in the Linux kernel's libceph OSD client. When a connection fault occurs during a sparse read, the sparse-read state is not properly reset. This allows a misbehaving or compromised Ceph OSD server, or a network adversary, to disrupt traffic. As a result, the client can misinterpr...

CVE-2026-41651

CVE-2026-41651 — Escalada de Privilegios Local TOCTOU en PackageKit Clasificación: Artefacto de Evaluación de Purple Team Solo uso autorizado. Este documento y el script de prueba adjunto están destinados exclusivamente a la validación de seguridad interna en sistemas donde se haya obtenido...

CVE-2026-12295-UXXS-in-my-wasm

CVE-2026-12295 — datos srcdoc en una URI que no es about:srcdoc UXSS en Firefox Prueba de concepto: un proceso de contenido comprometido falsifica una carga de PDocumentChannel cuyo nsDocShellLoadState transporta SrcdocData junto con una URI arbitraria. Las compilaciones vulnerables sirven el HTM...