GHSA-jpc4-w9r8-43j3

GHSA-jpc4-w9r8-43j3 — Statamic unauthorized arbitrary-extensio...

FEUP-3Y1S-FSI

FSI — Fundamentos de Segurança Informática Lab logbooks for...

EUVD-2026-109300

Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can...

EUVD-2026-109298

Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommerce: from n/a through 1.6.3...

EUVD-2026-109299

Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration...

EUVD-2026-109295

Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters. Web::Dispatch::ParamParser::getunpackedbodyfrom reads an application/x-www-form-urlencoded body using a single read call, with no cap and the return value ignored. Perl'...

Exploit for CVE-2026-114612

CVE-2026-114612 - LiteLLM Proxy Forged Admin Session PoC One...

CVE-2026-115557

Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration...

CVE-2026-115933

Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can...

Exploit for CVE-2026-111497

CVE‑2026‑111497 – Node.js Brotli Decoder...

GHSA-994f-577q-hhph

GHSA-994f-577q-hhph — TypeMill stored XSS via SVG XML styleshe...

Exploit for Integer Overflow or Wraparound in Libexpat_Project Libexpat

CVE-2024-45490 — libexpat XMLParseBuffer Negative-Length Po...

Exploit for CVE-2026-110264

Exploit...

CVE-2026-115933

The Postiz application is vulnerable to a critical flaw where it signs session, invitation, and password reset tokens using a single shared secret without specifying the token's purpose. A specific route refreshing browser-extension channel credentials allows users to submit signed data from a re...

CVE-2026-115933 Forged signed tokens let any registered user take over other users and organizations

Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can...

CVE-2026-114629

Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters. Web::Dispatch::ParamParser::getunpackedbodyfrom reads an application/x-www-form-urlencoded body using a single read call, with no cap and the return value ignored. Perl'...

CVE-2026-114191

Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommerce: from n/a through 1.6.3...

CVE-2026-115557 Distrust compromised intermediate certificates in ssl module

Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration...

CVE-2026-115557

Python's ssl module has been updated to include a denylist of known compromised certificates. This security enhancement ensures that compromised certificates are automatically rejected, providing protection even when certificate revocation is not explicitly configured. The update applies regardle...

Vulners Software Audit

Query the Vulners Software Audit API for known vulnerabilities matching one or more software products/versions CPE string or vendor:product:version. Bring-your-own-key BYOK: set apikey, plugin config, or VULNERSAPIKEY. Prefer plugin run vulners … as the hub; this scanner is a thin wrapper...