Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the UpsertWorkspaceApp process. An attacker can gain unauthorized access to another user's workspace app by submitting a crafted payload with a known victim app UUID and an...

Authentication Bypass by Alternate Name

Overview Affected versions of this package are vulnerable to Authentication Bypass by Alternate Name via improper handling of OIDC authentication and the emailverified claim. An attacker can gain unauthorized access to another user's account by authenticating with an email address matching the...

CVE-2026-35371

creationtimestamp| type| source ---|---|--- 2026-07-06 20:12:01+00:00| seen| https://gist.github.com/alon710/f5f0c292471d2cc05167d6fa94d49a4e...

GHSA-XV5W-CW7X-72GJ id: pretty-print uses effective GID instead of effective UID for name lookup

The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The implementation incorrectly uses the effective GID instead of the effective UID when performing a name lookup for the effective user. This results in misleadi...

EUVD-2026-25019

id: pretty-print uses effective GID instead of effective UID for name lookup...

CVE-2026-14536

creationtimestamp| type| source ---|---|--- 2026-07-06 19:52:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpyuiedjme2v...

CVE-2026-24013

creationtimestamp| type| source ---|---|--- 2026-07-06 19:09:37+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mpys3zc3ua2g 2026-07-06 20:30:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mpywluimbu2z 2026-07-08 06:37:06+00:00| seen|...

CVE-2026-58380

creationtimestamp| type| source ---|---|--- 2026-07-06 16:55:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpyklqfidn2z...

CVE-2025-53828

creationtimestamp| type| source ---|---|--- 2026-07-06 16:22:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpyiqllwq72d...

CVE-2025-53827

creationtimestamp| type| source ---|---|--- 2026-07-06 16:02:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpyhmrqo542c 2026-07-06 17:24:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mpym7ct5ri23...

ECHO-89C2-9149-2F37

Bulletin has no description...

ECHO-14ED-0EDC-CB07

Bulletin has no description...

ECHO-54D2-F1B2-3225

Bulletin has no description...

ECHO-BF99-96EE-AF6B

Bulletin has no description...

CVE-2026-28292 vulnerabilities

Vulnerabilities for packages: gemini-cli...

CVE-2026-12686

An authenticated user could manipulate a company ID parameter in a POST request to the backend to gain unauthorised access to other companies hosted within the same subdomain environment. The application does not adequately verify whether the requested company ID belongs to the authenticated user...

User Impersonation

Overview Affected versions of this package are vulnerable to User Impersonation in certain Thrift RPC query handlers, which do not strictly validate the sessionId parameter. An attacker can read time-series data without authenticating by sending query requests carrying a forged sessionId, which t...

PYSEC-2026-2080

Authentication Bypass by Spoofing vulnerability in Apache IoTDB. Certain Thrift RPC query handlers lack strict validation of the sessionId parameter. An attacker can construct requests with a forged sessionId and, without performing openSession authentication, receive valid query results. This...

CVE-2026-12686 Incorrect authorisation in Adiss’s Biloop

An authenticated user could manipulate a company ID parameter in a POST request to the backend to gain unauthorised access to other companies hosted within the same subdomain environment. The application does not adequately verify whether the requested company ID belongs to the authenticated user...

EUVD-2026-41857

Authentication Bypass by Spoofing vulnerability in Apache IoTDB. Certain Thrift RPC query handlers lack strict validation of the sessionId parameter. An attacker can construct requests with a forged sessionId and, without performing openSession authentication, receive valid query results. This...