62177 matches found
GHSA-596P-6JV8-775V
creationtimestamp| type| source ---|---|--- 2026-08-07 00:33:31+00:00| seen| https://gist.github.com/alon710/c7b44a1ea6b80e7066b89d9f2735b13f...
CVE-2026-52879: Uncontrolled Resource Consumption
Klever-Go is the Go implementation of the Klever blockchain protocol. In versions 1.7.14 through 1.7.17, the direct-message ingress handler spawns a new goroutine for every incoming direct message before the processor-level antiflood layer makes any admission decision, with no semaphore, throttle...
CVE-2026-17435: Improper Link Resolution Before File Access
File::Rotate::Simple versions before 0.4.0 for Perl create the target of dangling symlinks when rotating files. When the file to be rotated is a symbolic link to a missing file, and the touch option is enabled, then the rotate method assumes that the file is absent since the existence check is...
PT-2026-69186
Name of the Vulnerable Software and Affected Versions AI Copilot – Content Generator versions prior to 1.5.7 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can achieve full site...
PT-2026-69112
Name of the Vulnerable Software and Affected Versions File::Rotate::Simple versions prior to 0.4.0 Description When the touch option is enabled, the rotate function fails to correctly handle symbolic links pointing to missing files. Because the existence check is performed against the target of t...
PT-2026-68869
Name of the Vulnerable Software and Affected Versions MStore API versions prior to 4.21.0 Description The MStore API WordPress plugin fails to perform authorization or purchase-ownership checks on its REST product-review creation route. This allows an unauthenticated attacker to create WooCommerc...
CVE-2026-54202: Absolute Path Traversal
Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a path traversal vulnerability in the archive creation functionality. Because the archive path is user-controlled and insufficiently validated, an attacker can manipulate the input to traverse directories. This allows the creation of folde...
CVE-2026-17594: Incorrect Authorization
Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization vulnerability CWE-863 in the repository-creation user interface. An individual user account holding a delegated repository-admin privilege scoped to a specific repository format could create a repository of...
CVE-2026-46405: Allocation of Resources Without Limits or Throttling
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, in OpenBao's Kerberos auth method on the GET handler, or when an Authorization: Negotiate header is supplied, the response is includes a logical.Auth object in addition to an error message. This results in...
PT-2026-69056
Name of the Vulnerable Software and Affected Versions Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x Description An incorrect authorization issue exists in the repository-creation user interface. A user account with delegated repository-admin privileges for a specific repository format c...
PT-2026-68904
Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description The Webbox application allows an unauthenticated attacker to create or modify files on the server using attacker-controlled content. This occurs because user input is written directly to file...
PT-2026-68898
Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description Tobit Laboratories AG TeamDavid's Webbox contains a path traversal flaw in the archive creation functionality. This occurs because the archive path is user-controlled and lacks sufficient...
CVE-2026-19175
creationtimestamp| type| source ---|---|--- 2026-08-06 23:49:42+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117051240113170047 2026-08-07 04:48:39+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260807 2026-08-09 06:18:04+00:00| seen|...
GHSA-6HR6-W5QG-QMWG
creationtimestamp| type| source ---|---|--- 2026-08-06 23:32:34+00:00| seen| https://gist.github.com/alon710/91251538851544e4ecb69dd2c9aa7a2b 2026-08-07 00:07:12+00:00| seen| https://gist.github.com/alon710/91251538851544e4ecb69dd2c9aa7a2b...
CVE-2026-19138
creationtimestamp| type| source ---|---|--- 2026-08-06 23:24:57+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117051134731540251 2026-08-07 04:45:41+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260807 2026-08-13 09:46:23+00:00| seen|...
CVE-2026-64664
Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belonged to an existing user, without having permission to view...
CVE-2026-48085
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.1, a fully provisioned OpenReception instance accepts unauthenticated POST requests to /setup/create-admin-account and creates additional GLOBALADMIN accounts without...
CVE-2026-48085 OpenReception has unauthenticated GLOBAL_ADMIN account creation post-bootstrap
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.1, a fully provisioned OpenReception instance accepts unauthenticated POST requests to /setup/create-admin-account and creates additional GLOBALADMIN accounts without...
CVE-2026-48085 OpenReception has unauthenticated GLOBAL_ADMIN account creation post-bootstrap
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.1, a fully provisioned OpenReception instance accepts unauthenticated POST requests to /setup/create-admin-account and creates additional GLOBALADMIN accounts without...
