EUVD-2026-107049

The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL...

CVE-2026-71195

In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public share without re-authorizing against the share's actual...

CVE-2026-71195

OpenStack Manila versions before 23.0.1 are vulnerable to an incorrect authorization flaw where multiple API operations on public shares fail to verify if the caller owns the share. While controllers authorize against the caller's project context, they load foreign public shares without re-author...

EUVD-2026-107046

In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public share without re-authorizing against the share's actual...

CVE-2026-71195

In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public share without re-authorizing against the share's actual...

CVE-2026-71195

In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public share without re-authorizing against the share's actual...

CVE-2026-71195

In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public share without re-authorizing against the share's actual...

CLSA-2026-1784287739 kernel: Fix of 9 CVEs

xfs: resample the data fork mapping after cycling ILOCK - tls: Use skdstget and dstdevrcu in getnetdevforsock. CVE-2025-40149 - mpls: Use in6devrcu and devnetrcu in mplsforward and mplsxmit. - net: l3mdev: use skbdstdevrcu in l3mdevl3out - ipv4: start using dstdevrcu - tcp: use dstdevrcu in...

Buffer Access with Incorrect Length Value

Overview vyper is a Pythonic Smart Contract Language for the EVM. Affected versions of this package are vulnerable to Buffer Access with Incorrect Length Value via the getcreateforwardertobytecode function in vyper/functions/functions.py, which generated non-ERC-1167-compliant forwarder proxy...

Insufficient Verification of Data Authenticity

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via a forged client-supplied uuid field in multimodal content parts, which vLLM uses verbatim as the...

CVE-2026-114087

Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGICLINKSECRET lets anyone forge valid magic link tokens. Unauthenticated attackers can log in as any email address, then...

CVE-2026-114086

Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allows unauthenticated attackers to inject data into run streams. Attackers can send POST requests to /realtime/v1/streams/:runId/:streamId with a predictable run friendlyId to injec...

CVE-2026-114081

Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allowlisting or escaping. Authenticated customers can submit a backtick-quoted identifier to POST /api/v1/query that injects ...

CVE-2026-114068

Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to block runs belonging to other organizations. Attackers holding any secret API key can supply a victim run ID with their own waitpoint, causing that r...

CVE-2021-48019

Vyper before 0.2.9 deploys forwarder proxies through the built-in createforwarderto function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return data size. Calls through these proxies can yield corrupted data when a function returns more than 4096 bytes without return data...

CLEANSTART-2026-XC13093 Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service

Security vulnerability affects the nodejs-24 package. Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service...

CLEANSTART-2026-EG08504 attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames

CVE-2023-45288 affects multiple packages. An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. See references for individual vulnerability details...

EUVD-2026-106890

Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGICLINKSECRET lets anyone forge valid magic link tokens. Unauthenticated attackers can log in as any email address, then...

CVE-2026-114087

Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGICLINKSECRET lets anyone forge valid magic link tokens. Unauthenticated attackers can log in as any email address, then...

CVE-2026-114087 Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secrets

Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGICLINKSECRET lets anyone forge valid magic link tokens. Unauthenticated attackers can log in as any email address, then...