2174 matches found
PT-2026-21901
Name of the Vulnerable Software and Affected Versions Grafana affected versions not specified Description A time-of-create-to-time-of-use TOCTOU issue allows re-deletion of recently deleted and recreated data sources without authorization. The attack requires specific conditions: admin access to...
GHSA-FW7P-63QQ-7HPR vulnerabilities
Vulnerabilities for packages: sops, prometheus-mysqld-exporter, sops-fips, keda, db-operator, wolfictl, prometheus-mysqld-exporter-fips, apko, gitsign, step-ca-fips, croc, trillian, ratify-fips, step-ca, caddy, tkn-fips, age, step, spire-server-fips, spire-server, age-fips, mariadb-operator,...
GHSA-FW7P-63QQ-7HPR vulnerabilities
Vulnerabilities for packages: dgraph, wolfictl, spicedb, loki, openfga, step-ca, age, step, jitsucom-bulker, kots, sops, croc, gitea, fulcio, gitsign, minio, tkn, kyverno-policy-reporter, mariadb-operator, trillian, sqlexporter, spire-server, aactl, dex, kubeflow-pipelines, dbmate, caddy, k3s,...
Path Traversal in NLTK Downloader Package Metadata Allows Arbitrary File Write
Description The NLTK downloader does not validate file paths constructed from package metadata before writing downloaded files. A malicious NLTK data server can specify arbitrary paths via the subdir and id attributes in the package index XML, allowing arbitrary file write outside the intended...
Missing Cryptographic Step
Overview org.webjars.npm:jsrsasign is a free pure JavaScript cryptographic library. Affected versions of this package are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation. An attacker can recover the private key by...
Missing Cryptographic Step
Overview jsrsasign is a free pure JavaScript cryptographic library. Affected versions of this package are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation. An attacker can recover the private key by forcing r or s to be...
12 Step Meeting List < 3.16.6 - Unauthenticated Sensitive Information Exposure
The 12 Step Meeting List plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.16.5.This makes it possible for unauthenticated attackers to extract sensitive user or configuration data via two AJAX endpoints: tsmlinfo and tsmlgeocodes. id:...
CVE-2026-1537
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the loadstep function in all versions up to, and including, 5.2.6. This makes it possible for unauthenticated attackers to vie...
CVE-2026-1537
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the loadstep function in all versions up to, and including, 5.2.6. This makes it possible for unauthenticated attackers to vie...
CVE-2026-1537
CVE-2026-1537 pertains to the WordPress plugin LatePoint – Calendar Booking Plugin for Appointments and Events. The vulnerability is an missing authorization to booking details exposure in all versions up to and including 5.2.6, enabling unauthenticated attackers to view sensitive booking data (c...
CVE-2026-1537 LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Missing Authorization to Booking Details Exposure
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the loadstep function in all versions up to, and including, 5.2.6. This makes it possible for unauthenticated attackers to vie...
CVE-2026-1537 LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Missing Authorization to Booking Details Exposure
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the loadstep function in all versions up to, and including, 5.2.6. This makes it possible for unauthenticated attackers to vie...
PT-2026-7813
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the load step function in all versions up to, and including, 5.2.6. This makes it possible for unauthenticated attackers to vi...
SecCodePRM: A Process Reward Model for Code Security
Large Language Models are rapidly becoming core components of modern software development workflows, yet ensuring code security remains challenging. Existing vulnerability detection pipelines either rely on static analyzers or use LLM/GNN-based detectors trained with coarse program-level...
CVE-2025-13192: Improper Neutralization of Special Elements used in an SQL Command
The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to generic SQL Injection via the multiple REST API endpoints in all versions up to, and including, 2.2.0 due to insufficient escaping on the user supplied...
CVE-2026-25518 vulnerabilities
Vulnerabilities for packages: percona-xtradb-cluster-operator, cert-manager-istio-csr, step-issuer-fips, cert-manager-google-cas-issuer-fips, cert-manager-openshift-routes-fips, cert-manager-cmctl, mariadb-operator-fips, gitlab-operator, aws-privateca-issuer, cert-manager-csi-driver,...
CVE-2026-25518 vulnerabilities
Vulnerabilities for packages: mariadb-operator, cert-manager-csi-driver, cert-manager-webhook-pdns, opentelemetry-operator, aws-privateca-issuer, cert-manager-istio-csr, percona-server-mongodb-operator, cert-manager-cmctl, step-issuer...
CLEANSTART-2026-KV78041 processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input
Multiple security vulnerabilities affect the step-issuer-fips package. The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. See references for individual vulnerability details...