50278 matches found
Statamic CMS exposes two-factor recovery codes through dynamic Antlers rendering
Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the twofactorrecoverycodes handle that returns the user's raw two-factor recovery codes with no access restriction: if $handle === 'twofactorrecoverycodes' return new...
CVE-2026-50749 Apache Answer: Missing authorization in revision audit reject allows authenticated users to reject pending revisions
Improper Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Any authenticated user can reject arbitrary pending edit-revisions without review permission due to a missing authorization check on the reject operation. Users are recommended to upgrade to...
CVE-2026-48912
Improper Input Validation vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. A missing ownership check in the avatar-cleanup logic allows any authenticated user to delete other users' uploaded files by supplying their file URLs. Users are recommended to upgrade to...
axios: axios: Denial of Service due to maxBodyLength bypass in HTTP/2 requests
A flaw was found in axios, a popular JavaScript library for making HTTP requests. When using the Node.js HTTP/2 adapter, axios fails to properly enforce the configured maxBodyLength limit for streamed request bodies. This allows a remote attacker, by controlling the input stream, to send an...
CVE-2026-17506
The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 notfoundurl tracking parameter in versions up to, and including, 2.15.0. This is due to the getcellcontent function applying urldecode after escurl when rendering the URL column for 404 entries...
Malicious code in devplatform-spa-testing (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d43b8f8982db0f563db0d728dbc9ecdd9907e29dd45f2d9bf42e0c8416fc80fa On require'devplatform-spa-testing', index.js loads platform.js which selects a platform-specific endpoint, retrieves a payload over HTTPS from...
CVE-2026-71289
creationtimestamp| type| source ---|---|--- 2026-08-05 13:30:26+00:00| seen| https://infosec.exchange/users/offseq/statuses/117043142705707824 2026-08-05 13:30:28+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3msdn56d7is2i 2026-08-05 15:02:18+00:00| seen|...
CVE-2026-17506
CVE-2026-17506 affects the Independent Analytics plugin for WordPress up to version 2.15.0. The vulnerability is a Stored XSS in the 404 not_found_url tracking parameter caused by get_cell_content() applying urldecode() after esc_url() when rendering the URL column for 404 entries, allowing perce...
CVE-2026-71293
Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user's raw two-factor recovery codes with no access restriction...
CLSA-2026-1785934477 TuxCare security update for certifi (2 CVEs)
TuxCare rebuilt certifi to address 2 CVEs. Fixed in 2021.10.8.post4+tuxcare...
CVE-2026-71293
Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user's raw two-factor recovery codes with no access restriction...
CVE-2026-71293 Statamic CMS Unguarded Exposure of 2FA Recovery Codes via Antlers current_user Variable
Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user's raw two-factor recovery codes with no access restriction...
CVE-2026-71293
CVE-2026-71293 (Statamic CMS) : The AugmentedUser::get() handler exposes a dedicated case for the two_factor_recovery_codes handle, returning raw 2FA recovery codes without access restrictions. This bypass is not mitigated by password-hash exclusions, and two_factor_recovery_codes is not protecte...
EUVD-2026-53378
Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the twofactorrecoverycodes handle that returns the user's raw two-factor recovery codes with no access restriction: if $handle === 'twofactorrecoverycodes' return new...
Malicious code in saas-f-lego-landings (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c96f58511420dcd956adbe21ee52dd1acae9956f5b562887a5c6659679fb52d [email protected] executes a native binary dropper as a side effect of loading the package. index.js unconditionally requires./support.js,...
CVE-2026-71266
tinyobjloader-c's tinyobjparseandindexmtlfile tinyobjloaderc.h reads each line of a .mtl material file into a fixed 4096-byte stack buffer via memcpylinebuf, p, plen, guarded only by . The identical vulnerable pattern is duplicated in a second function in the same file...
CVE-2026-71245
creationtimestamp| type| source ---|---|--- 2026-08-05 12:14:36+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3msdivizqws2r 2026-08-05 12:14:37+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117042844511124715...
WordPress Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin <= 6.2.8 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os in WordPress Plugin FluentForm versions = 6.2.8...
CVE-2026-71206
creationtimestamp| type| source ---|---|--- 2026-08-05 11:09:08+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3msdfahr6m52a 2026-08-05 11:09:14+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117042587175345568 2026-08-17 18:00:04+00:00| seen|...