GHSA-6GQR-MX34-WH8R Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection

TL;DR This vulnerability affects all Kirby sites where users of a particular role have no permission to create pages, files or users pages.create, files.create or users.create permission is disabled. This can be due to configuration in the user blueprints, via options in the model blueprints or v...

Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection

TL;DR This vulnerability affects all Kirby sites where users of a particular role have no permission to create pages, files or users pages.create, files.create or users.create permission is disabled. This can be due to configuration in the user blueprints, via options in the model blueprints or v...

CVE-2026-41427

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.5, the clientPrivileges option documents a create action, but the OAuth client creation endpoints did not invoke the hook before persisting new clients. Deployments that configured clientPrivileges to restrict...

CVE-2026-41328

creationtimestamp| type| source ---|---|--- 2026-04-24 19:42:54+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkbbw67je32f 2026-04-25 04:30:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116463463879285208 2026-04-25 04:30:31+00:00| seen|...

EUVD-2026-25620

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From 0.4.0 to before 0.8.0, a flaw in the Java agent injection path allows a local attacker controlling a Java workload to overwrite arbitrary host files when Java injection is enabled and OBI is...

CVE-2026-41433

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From 0.4.0 to before 0.8.0, a flaw in the Java agent injection path allows a local attacker controlling a Java workload to overwrite arbitrary host files when Java injection is enabled and OBI is...

GHSA-6V9C-7CG6-27Q7

creationtimestamp| type| source ---|---|--- 2026-04-24 19:23:26+00:00| seen| Telegram/FGivxNz61ghqDj4ER4orUo942MC3d41x9N89ngSi7socZnE 2026-04-30 02:10:29+00:00| seen| https://gist.github.com/alon710/e87f10931158991f62fe5f3be1e4d663...

GHSA-PF86-5X62-JRWF

creationtimestamp| type| source ---|---|--- 2026-04-24 19:23:26+00:00| seen| Telegram/FGivxNz61ghqDj4ER4orUo942MC3d41x9N89ngSi7socZnE 2026-05-05 03:10:29+00:00| seen| https://gist.github.com/alon710/207351104330f20458b16ad3e50712e0...

CVE-2026-41427

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.5, the clientPrivileges option documents a create action, but the OAuth client creation endpoints did not invoke the hook before persisting new clients. Deployments that configured clientPrivileges to restrict...

CVE-2026-6911

creationtimestamp| type| source ---|---|--- 2026-04-24 19:23:03+00:00| published-proof-of-concept| Telegram/KzwiN8QhKmj3TuqYtGeX9siiyoqjfAY8f7zipbEz0Wiqhk 2026-04-25 07:30:26+00:00| seen| https://infosec.exchange/users/offseq/statuses/116464171469215765 2026-04-25 07:30:28+00:00| seen|...

GHSA-8C75-8MHR-P7R9

creationtimestamp| type| source ---|---|--- 2026-04-24 19:23:03+00:00| published-proof-of-concept| Telegram/KzwiN8QhKmj3TuqYtGeX9siiyoqjfAY8f7zipbEz0Wiqhk...

CVE-2026-6912

creationtimestamp| type| source ---|---|--- 2026-04-24 19:23:03+00:00| published-proof-of-concept| Telegram/KzwiN8QhKmj3TuqYtGeX9siiyoqjfAY8f7zipbEz0Wiqhk...

GHSA-V5VR-8W3C-37X2

creationtimestamp| type| source ---|---|--- 2026-04-24 19:23:03+00:00| published-proof-of-concept| Telegram/KzwiN8QhKmj3TuqYtGeX9siiyoqjfAY8f7zipbEz0Wiqhk...

GHSA-VFMQ-68HX-4JFW

creationtimestamp| type| source ---|---|--- 2026-04-24 19:23:03+00:00| published-proof-of-concept| Telegram/KzwiN8QhKmj3TuqYtGeX9siiyoqjfAY8f7zipbEz0Wiqhk...

CVE-2026-40897

creationtimestamp| type| source ---|---|--- 2026-04-24 19:22:45+00:00| seen| Telegram/6Kzjgs5Jm1YsIV5W18stSaCNyR3ZbpfLU45htDdv-YDitI 2026-04-29 05:40:29+00:00| seen| https://gist.github.com/alon710/25629451db7d7ca933d6d9a4e21d4536 2026-05-07 09:00:04+00:00| seen|...

CVE-2026-23361

creationtimestamp| type| source ---|---|--- 2026-04-24 19:22:15+00:00| seen| Telegram/QClwe-Hyi-f9OAkRKp4TGZeua-ugJd0Tlr7uuGoxl9Cbid8 2026-06-29 20:05:14+00:00| seen| https://bsky.app/profile/cybernewsroom.bsky.social/post/3mphbwyjmmv2o 2026-06-29 20:05:19+00:00| seen|...

CVE-2026-23344

creationtimestamp| type| source ---|---|--- 2026-04-24 19:22:15+00:00| seen| Telegram/QClwe-Hyi-f9OAkRKp4TGZeua-ugJd0Tlr7uuGoxl9Cbid8...

CVE-2026-41907

uuid is for the creation of RFC9562 formerly RFC4122 UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes small buf or large offset. This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0...

CVE-2026-41907

uuid is for the creation of RFC9562 formerly RFC4122 UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes small buf or large offset. This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0...

EUVD-2026-25600

uuid is for the creation of RFC9562 formerly RFC4122 UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes small buf or large offset. This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0...