Bugsink: Issue event views can show an event from another project if its UUID is known

DescriptionBugsink issue event pages accept a direct event identifier from the URL and, in affected versions, look up that event without also requiring it to belong to the issue in the URL.This is a project-boundary authorization issue: a logged-in user with access to one project can view another...

django-manifold (>=1.0.0, <=1.3.0), django-view-breadcrumbs (>=0.0.1, <=0.0.3) +1 more potentially affected by CVE-2026-53877 via django (2.0.2)

django PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-manifold =1.0.0, =0.0.1, =0.0.3 - mapistar 0.1.0 Source cves: CVE-2026-53877 Source advisory: OSV:GHSA-CRHF-3PFG-W68W...

CVE-2026-50704 Frappe Framework 17.0.0-dev - Reflected/Stored XSS in File View breadcrumbs rendering

A Stored Cross-Site Scripting XSS vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the File View breadcrumb renderer...

CVE-2026-50704 Frappe Framework 17.0.0-dev - Reflected/Stored XSS in File View breadcrumbs rendering

A Stored Cross-Site Scripting XSS vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the File View breadcrumb renderer...

CVE-2026-50704

CVE-2026-50704 affects Frappe Framework 17.0.0-dev. The issue is a Stored XSS caused by improper neutralization of user-controlled input in the File View breadcrumb renderer. The vulnerability could allow an attacker to inject scripts via breadcrumbs, with the potential impact limited to the affe...

CVE-2026-54717 - XSS in breadcrumbs in page list view

More info at https://www.silverstripe.org/download/security-releases/cve-2026-54717...

EUVD-2026-31861

Bugsink: Issue event views can show an event from another project if its UUID is known...

GHSA-VX2F-6M6H-9FRF Bugsink: Issue event views can show an event from another project if its UUID is known

Description Bugsink issue event pages accept a direct event identifier from the URL and, in affected versions, look up that event without also requiring it to belong to the issue in the URL. This is a project-boundary authorization issue: a logged-in user with access to one project can view anoth...

CVE-2026-8708

The Genzel breadcrumbs plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing or incorrect nonce validation on the optionspage function. This makes it possible for unauthenticated attackers to update the plugin's breadcru...

django-manifold (>=1.0.0, <=1.3.0), django-view-breadcrumbs (>=0.0.1, <=0.0.3) +1 more potentially affected by CVE-2026-8404 via django (2.0.2)

django PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-manifold =1.0.0, =0.0.1, =0.0.3 - mapistar 0.1.0 Source cves: CVE-2026-8404 Source advisory: OSV:GHSA-8CJM-8MP7-R2XF...

cosmicdb (>=0.0.32, <=0.0.33), cosmicdbsemantic (>=0.0.38, <=0.0.39) +5 more potentially affected by CVE-2026-8404 via django (3.1.1)

django PYPI version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - cosmicdb =0.0.32, =0.0.38, =0.2.0, =8.6.1, =1.10.1, =1.12.4 Source cves: CVE-2026-8404 Source advisory: OSV:GHSA-8CJM-8MP7-R2XF...

cosmicdb (>=0.0.32, <=0.0.33), cosmicdbsemantic (>=0.0.38, <=0.0.39) +5 more potentially affected by CVE-2026-6873 via django (3.1.1)

django PYPI version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - cosmicdb =0.0.32, =0.0.38, =0.2.0, =8.6.1, =1.10.1, =1.12.4 Source cves: CVE-2026-6873 Source advisory: OSV:GHSA-H7PC-VWP9-298G...

django-manifold (>=1.0.0, <=1.3.0), django-view-breadcrumbs (>=0.0.1, <=0.0.3) +1 more potentially affected by CVE-2026-6873 via django (2.0.2)

django PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-manifold =1.0.0, =0.0.1, =0.0.3 - mapistar 0.1.0 Source cves: CVE-2026-6873 Source advisory: OSV:GHSA-H7PC-VWP9-298G...

CVE-2025-12714

The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the updatesiteeditorhomepage function in all versions up to, and including, 1.0.271. This makes it possible for unauthenticated attackers to...

EUVD-2025-209984

The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the updatesiteeditorhomepage function in all versions up to, and including, 1.0.271. This makes it possible for unauthenticated attackers to...

CVE-2025-12714

The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the updatesiteeditorhomepage function in all versions up to, and including, 1.0.271. This makes it possible for unauthenticated attackers to...

WordPress plugin Rank Math SEO 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

PT-2026-44796

Name of the Vulnerable Software and Affected Versions Rank Math SEO versions prior to 1.0.272 Description The Rank Math SEO plugin for WordPress allows unauthorized access because the update site editor homepage function lacks a capability check. This allows unauthenticated attackers to modify...

CVE-2026-47715

Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, Bugsink issue event pages accept a direct event identifier from the URL and, in affected versions, look up that event without also requiring it to belong to the issue in the URL. This is a project-boundary authorization issue: a...

CVE-2026-8708

The Genzel breadcrumbs plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing or incorrect nonce validation on the optionspage function. This makes it possible for unauthenticated attackers to update the plugin's breadcru...