62406 matches found
CVE-2026-1667: Missing Authorization
The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Arbitrary Post Creation and Stored Cross-Site Scripting in all versions up to, and including, 14.0.0 due to a leak of an API token and insufficient input sanitization and output escaping. This makes it possible for unauthenticat...
PT-2026-75983
decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries type === 'link', the x.linkname field from the archive is passed directly to fs.link without validation index.js line 113. An...
CVE-2026-21053: Undefined Security Weakness
Improper input validation in Samsung Email prior to version 6.2.13.1 allows local attackers to create arbitrary files within the application sandbox...
Coder < 2.29.7 / 2.30.x < 2.30.2 Workspace Auto-Creation Without Consent (CVE-2026-44454)
The version of Coder installed on the remote host is prior to 2.29.7 or 2.30.x prior to 2.30.2. It is, therefore, affected by a command injection vulnerability. The dotfiles registry module passed unsanitized user input to shell commands, enabling arbitrary code execution inside provisioned...
PT-2026-57056
OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization...
CVE-2026-44918
OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization...
PT-2026-57228
The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Arbitrary Post Creation and Stored Cross-Site Scripting in all versions up to, and including, 14.0.0 due to a leak of an API token and insufficient input sanitization and output escaping. This makes it possible for unauthenticat...
CVE-2026-44918
OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization...
CVE-2026-44918
OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization...
CVE-2026-44918
OpenStack Ironic (up to 37.0.1) allows an authenticated project manager to create/modify nodes across projects without authorization, potentially misconfiguring which project owns a node and exposing secrets stored in volume connectors/targets. Red Hat notes a specific flaw where a manager can re...
CVE-2026-56312: Improper Authentication
Capgo before 12.128.2 contains an improper validation vulnerability in the acceptinvitation endpoint that creates user accounts before captcha validation is enforced. Attackers can bypass captcha protection by sending POST requests with invalid captcha tokens to create unwanted accounts and burn...
CVE-2026-12598
creationtimestamp| type| source ---|---|--- 2026-07-09 23:57:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqatkxb6dv26 2026-07-10 02:00:14+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqb2gy4ouu2i...
CVE-2026-12595
creationtimestamp| type| source ---|---|--- 2026-07-09 23:52:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqatbxlm5v2x 2026-07-10 01:00:56+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqax4vap6h2m...
CVE-2026-59269
creationtimestamp| type| source ---|---|--- 2026-07-09 23:09:00+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqaqupneqf2s 2026-07-10 03:34:11+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116893578077059959...
CVE-2026-44787
creationtimestamp| type| source ---|---|--- 2026-07-09 23:04:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqaqmco25h25 2026-07-19 19:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqzjp4zwah26...
CVE-2026-13253
creationtimestamp| type| source ---|---|--- 2026-07-09 22:36:06+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqaozyvdmo2y 2026-07-09 22:36:07+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mqaozzguty2m...
CVE-2026-13334
creationtimestamp| type| source ---|---|--- 2026-07-09 22:33:58+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mqaow6cts72m 2026-07-09 22:34:00+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqaowapx3u22...
CVE-2026-39243
decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries type === 'link', the x.linkname field from the archive is passed directly to fs.link without validation index.js line 113. An...
CVE-2026-39246
decompress before 4.2.2 allows arbitrary symlink creation during archive extraction. When processing symlink entries type === 'symlink', the x.linkname field from the archive is passed directly to fs.symlink without validation index.js line 121. The preventWritingThroughSymlink check on line 98...