6735 matches found
CVE-2026-53062 affecting package kernel for versions less than 6.6.143.1-1
CVE-2026-53062 affecting package kernel for versions less than 6.6.143.1-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-13595 affecting package util-linux for versions less than 2.40.2-5
CVE-2026-13595 affecting package util-linux for versions less than 2.40.2-5. A patched version of the package is available...
CVE-2026-53356 affecting package kernel for versions less than 6.6.143.1-1
CVE-2026-53356 affecting package kernel for versions less than 6.6.143.1-1. An upgraded version of the package is available that resolves this issue...
NPM: Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption
NPM: Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption vulnerability discovered by ? in WordPress Npm better-auth versions = 1.4.8-beta.7, 1.6.0...
NPM: Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp
NPM: Better Auth has stored XSS in the auth-server origin via javascript: redirecturi in oidc-provider and mcp vulnerability discovered by ? in WordPress Npm better-auth versions 1.6.13...
NPM: Better Auth has an account takeover issue via OAuth auto-link to unverified pre-registered email
NPM: Better Auth has an account takeover issue via OAuth auto-link to unverified pre-registered email vulnerability discovered by ? in WordPress Npm better-auth versions 1.6.11...
NPM: Better Auth vulnerable to unauthorized invitation acceptance via unverified email match in organization plugin
NPM: Better Auth vulnerable to unauthorized invitation acceptance via unverified email match in organization plugin vulnerability discovered by ? in WordPress Npm better-auth versions 1.6.11...
pgadmin4 is affected by a Cross-Origin Opener Policy (COOP) vulnerability
pgAdmin = 9.7 is affected by a Cross-Origin Opener Policy COOP vulnerability.This vulnerability allows an attacker to manipulate the OAuth flow,potentially leading to unauthorised account access, account takeover, data breaches, and privilege escalation...
PYSEC-2026-2045 Werkzeug safe_join not safe on Windows
On Python = 3.11, or not using Windows, are not vulnerable...
Cross-Frame Scripting vulnerability has been found on Plone CMS
A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting version below 6.0.5. An attacker could store a malicious URL to be opened by an administrator and execute a malicios iframe element...
PYSEC-2026-1797 Cross-Frame Scripting vulnerability has been found on Plone CMS
A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting version below 6.0.5. An attacker could store a malicious URL to be opened by an administrator and execute a malicios iframe element...
OS Command Injection in Apache Airflow
Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache Airflow Hive Provider, Apache Airflow allows an attacker to execute arbtrary commands in the task execution context, without write access to DAG files. This issue affects Hive Provider...
WordPress Printcart Web to Print Product Designer for WooCommerce plugin <= 2.5.2 - Unauthenticated Arbitrary File Deletion vulnerability
Unauthenticated Arbitrary File Deletion vulnerability discovered by tjoffe in WordPress Plugin Printcart Web to Print Product Designer for WooCommerce versions = 2.5.2...
Access control issue in AlekSIS-Core
An access control issue in aleksis/core/util/authhelpers.py: ClientProtectedResourceMixin of AlekSIS-Core v2.8.1 and below allows attackers to access arbitrary scopes if no allowed scopes are specifically set...
CVE-2026-22555 Gitea organization forks can expose organization secrets without create permission
Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first passing the CanCreateOrgRepo check, which can expose organization secrets...
EUVD-2026-41530
A vulnerability exists in the Kong Konnect Model Context Protocol MCP server prior to version 1.0.0, which could allow a remote attacker to perform an indirect prompt injection attack and execute unintended API requests...
NPM: 9router: Missing Authorization and OS Command Injection
NPM: 9router: Missing Authorization and OS Command Injection vulnerability discovered by ? in WordPress Npm 9router versions 0.4.44...
CVE-2026-57764
Contributor Cross Site Scripting XSS in Surbma | Yoast SEO Breadcrumb Shortcode = 1.2 versions...