160234 matches found
PT-2026-106024
auto-changelog before 2.6.1 merges configuration from inside the target repository the .auto-changelog file and the auto-changelog key in package.json into its options, and honors security-sensitive options from that untrusted source. The handlebarsSetup option is passed to require, so running...
EUVD-2026-92020
OpenAM before 16.1.3 contains a latent cross-site scripting defect that places the SAML message, relay state and target URL unencoded into the load-balancer cookie bounce auto-submit page. If reachable with cookieHashRedirectEnabled set, crafted requests could execute script in the OpenAM origin,...
CVE-2026-105116
OpenAM versions prior to 16.1.3 are affected by a latent cross-site scripting (XSS) defect. The vulnerability occurs because the SAML message , relay state , and target URL are placed unencoded into the load-balancer cookie bounce auto-submit page. If the cookieHashRedirectEnabled setting is acti...
CVE-2026-94505
The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
CVE-2026-94505
The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to an authorization bypass in all versions up to and including 4.5.0 . The root cause is the plugin's failure to properly verify user permissions before performing actions. This allows authentica...
EUVD-2026-91961
The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
CVE-2026-105116: Improper Neutralization of Input During Web Page Generation
OpenAM before 16.1.3 contains a latent cross-site scripting defect that places the SAML message, relay state and target URL unencoded into the load-balancer cookie bounce auto-submit page. If reachable with cookieHashRedirectEnabled set, crafted requests could execute script in the OpenAM origin,...
PT-2026-104577
Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.3 Description A cross-site scripting defect exists where the SAML message, relay state, and target URL are placed unencoded into the load-balancer cookie bounce auto-submit page. This issue is reachable when...
PT-2026-104548
Name of the Vulnerable Software and Affected Versions Nelio Content – Editorial Calendar & Social Media Auto-Posting versions prior to 4.5.1 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows...
JetBrains Rider < 2026.2.1 Unverified Skill Auto-Update
The version of JetBrains Rider installed on the remote host is prior to 2026.2.1. It is, therefore, affected by a vulnerability: - In JetBrains Rider before 2026.2.1 AI Assistant could auto-update third-party skills without user confirmation. CVE-2026-100265 Note that Nessus has not tested for th...
MAL-2026-17444 Malicious code in danz-bails (npm)
This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...
CVE-2026-102277 vulnerabilities
Vulnerabilities for packages: opensearch-dashboards-fips, graalvm, redisinsight, arangodb, wazuh-dashboard, sqlpad, commercial-gitlab-rails-ee, unleash-proxy, tensorflow-gpu-jupyter, langfuse-fips, lerna, prism, authentik, unleash-fips, authentik-fips, opentelemetry-auto-instrumentations-node, np...
GHSA-QHR7-859C-M2P7 vulnerabilities
Vulnerabilities for packages: opensearch-dashboards-fips, graalvm, redisinsight, arangodb, wazuh-dashboard, sqlpad, commercial-gitlab-rails-ee, unleash-proxy, tensorflow-gpu-jupyter, langfuse-fips, lerna, prism, authentik, unleash-fips, authentik-fips, opentelemetry-auto-instrumentations-node, np...
CVE-2026-102278 vulnerabilities
Vulnerabilities for packages: opensearch-dashboards-fips, graalvm, redisinsight, arangodb, wazuh-dashboard, sqlpad, commercial-gitlab-rails-ee, unleash-proxy, tensorflow-gpu-jupyter, langfuse-fips, lerna, prism, authentik, unleash-fips, authentik-fips, opentelemetry-auto-instrumentations-node, np...
GHSA-Q2HR-2G5M-VWHR vulnerabilities
Vulnerabilities for packages: opensearch-dashboards-fips, graalvm, redisinsight, arangodb, wazuh-dashboard, sqlpad, commercial-gitlab-rails-ee, unleash-proxy, tensorflow-gpu-jupyter, langfuse-fips, lerna, prism, authentik, unleash-fips, authentik-fips, opentelemetry-auto-instrumentations-node, np...
CentOS Linux 8 [TuxCare] Security Update: ctdb / libnetapi / libnetapi-devel / libsmbclient / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1781101271)
The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1781101271 advisory. - A flaw was found in Samba's certificate auto-enrollment Group Policy handling. When certificate auto- enrollment is enabled,...
airflow-indexima (>=1.0.1, <=2.2.1), arcli (>=0.1.0, <=0.1.1) +69 more potentially affected by CVE-2026-87819 via gitpython (2.1.15)
gitpython PYPI version 2.1.15 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - airflow-indexima =1.0.1, =0.1.0, =0.3.0rc1, =0.1.0, =0.7.0, =0.2.0, =0.11.0, =0.1.0, =0.6.0, =0.3.0, =2.0.0, =2019.2.3rc0, =2021.7.0 and more...
CVE-2026-100265
In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation...
CVE-2026-100265
In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation...
CVE-2026-100265
JetBrains Rider versions prior to 2026.2.1 are affected by a vulnerability where the AI Assistant could automatically update third-party skills without requiring explicit user confirmation. The provided documents do not specify the underlying root cause, the specific impact beyond unauthorized up...