PT-2026-69870

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.6 Discourse versions prior to 2026.5.2 Discourse versions prior to 2026.6.1 Discourse versions prior to 2026.7.0 Description The Rich Text Editor renders a chat-transcript username as HTML, which enables stor...

CVE-2026-14450: Authentication Bypass by Spoofing

A flaw was found in the MaaS API. This vulnerability allows any pod within the cluster to bypass the Kuadrant AuthPolicy gateway by forging HTTP headers, specifically X-MaaS-Username and X-MaaS-Group, which are trusted verbatim. This lack of first-party authentication enables an attacker to gain...

📄 WordPress 7.0.2 Code Execution / Cross Site Scripting

A proof of concept exploit for a reflected cross site scripting vulnerability in WordPress version 7.0.2. The vulnerability results from a parser differential between PHP striptags and WordPress KSES processing of usernames supplied to wp-login.php, allowing attacker-controlled markup to survive...

CVE-2026-72730: Improper Neutralization of Input During Web Page Generation

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the Rich Text Editor rendered a chat-transcript username as HTML, allowing stored cross-site scripting. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0...

CVE-2026-6791: Stack-based Buffer Overflow

When expanding paths that begin with a tilde followed by a username, the internal parsetilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this...

CVE-2026-71958 D-Link DWR-M961 Buffer Overflow via quicksetup.cgi

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2C1202602110044 contain a buffer overflow vulnerability in the quicksetup.cgi interface. A remote attacker can write overly long strings to the test4, ssid2, and username fields and execute arbitrary commands by crafting a...

CVE-2026-71958

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2C1202602110044 contain a buffer overflow vulnerability in the quicksetup.cgi interface. A remote attacker can write overly long strings to the test4, ssid2, and username fields and execute arbitrary commands by crafting a...

EUVD-2026-54810

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2C1202602110044 contain a buffer overflow vulnerability in the quicksetup.cgi interface. A remote attacker can write overly long strings to the test4, ssid2, and username fields and execute arbitrary commands by crafting a...

CVE-2026-71958

The CVE-2026-71958 entry concerns D-Link DWR-M961 devices (hardware version C1, software 1.1.2_C1_202602110044). The vulnerability is a buffer overflow in the quicksetup.cgi interface. An unauthenticated remote attacker can supply oversized inputs to the test4, ssid2, and username fields to cause...

DEBIAN-CVE-2026-54338

JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and...

UBUNTU-CVE-2026-54338

JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and...

CVE-2026-54338

JupyterHub prior to 5.5.0 is affected by a vulnerability in its form-based login authenticators where invalid input can place an attacker-controlled username into failed-login logs. This can allow an unauthenticated attacker to exhaust logging and storage resources, effectively a denial of servic...

CVE-2026-54338 JupyterHub: Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login

JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and...

CVE-2026-54338

JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and...

CVE-2026-54338 JupyterHub: Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login

JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and...

JLSEC-2026-1215 When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL...

When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a usernamewithout a password, like https://[email protected]/, curl could wrongly get and use the password for another user set in the .netrc file for that host if such a one exists and there is no...

CVE-2026-71326

Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.6.25 and 3.7.10, Traefik's BasicAuth middleware in pkg/middlewares/auth/basicauth.go deduplicates concurrent password checks with a singleflight key built from the delimiter-free concatenation of password and...

Malicious code in wos-library-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3124274f6fcb74cf0805b5545f6952214b90329427f55c616c868f760d592e63 [email protected] declares scripts.preinstall = 'node poc.js', which auto-runs on npm install. poc.js reads os.hostname, os.userInfo.username, an...

MAL-2026-13467 Malicious code in wos-library-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3124274f6fcb74cf0805b5545f6952214b90329427f55c616c868f760d592e63 [email protected] declares scripts.preinstall = 'node poc.js', which auto-runs on npm install. poc.js reads os.hostname, os.userInfo.username, an...

MAL-2026-13436 Malicious code in @wbnr/frontend-shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6208a0da32b8b7ae795d85ecbf95788b876729db08b0a595ad24f05a02dbbdbe The package declares a preinstall lifecycle script preinstall.js that automatically runs on npm install. The script reads the installer's OS username...