57330 matches found
GHSA-8GH5-QQH8-HQ3X Open WebUI allows limited stored XSS vila uploaded html file
Summary Low privileged users can upload HTML files which contain JavaScript code via the /api/v1/files/ backend endpoint. This endpoint returns a file id, which can be used to open the file in the browser and trigger the JavaScript code in the user's browser. Under the default settings, files...
GO-2026-5908 Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder
Coder vulnerable to OIDC account takeover via email-based user matching and emailverified bypass in github.com/coder/coder...
GO-2026-5855 Fission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escape in github.com/fission/fission
Fission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escape in github.com/fission/fission...
CVE-2026-53878
creationtimestamp| type| source ---|---|--- 2026-07-07 15:04:59+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mq2uvi6mb22w 2026-07-07 16:03:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2y6fbxvq23...
PYSEC-2026-1775 OAuth2 client ID and secret exposed through the web browser
pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data...
MINI-8RQG-VHVG-WQ2V
Bulletin has no description...
Court Filing Reveals Windows Device ID Helped FBI Trace Alleged Scattered Spider Hacker
U.S. prosecutors linked an alleged Scattered Spider hacker to a break-in at a luxury jewelry retailer using a persistent Windows device ID, according to a newly unsealed federal complaint. Microsoft records tied that ID first to the account the attackers used to keep access during the May 2025...
CVE-2026-53483
creationtimestamp| type| source ---|---|--- 2026-07-07 13:12:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq2olmx4az2r 2026-07-07 15:42:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2wy66mom2o 2026-07-09 03:07:07+00:00| seen|...
389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND
A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. After a successful SASL bind with integrity protection SSF 0, an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer...
GHSA-H9QX-V5XP-PH8P EGroupware has a Remote Code Execution Vulnerability
Summary A critical vulnerability has been identified in EGroupware that may lead to Remote Code Execution RCE. The issue allows an authenticated attacker to execute arbitrary commands on the server. If user self-registration is enabled, the vulnerability may be exploitable without prior...
MAL-2026-9954 Malicious code in zzjinavcssvn (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-9547 Malicious code in xwandservmtg (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-9103 Malicious code in vand3flmy1778552525 (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-9091 Malicious code in v4zzgbqvirfx (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-8938 Malicious code in swkefepbkjgqj (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-8213 Malicious code in oaigx7857181 (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7956 Malicious code in lbrssypnbowmaf (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7455 Malicious code in myproject234 (PyPI)
--- -= Per source details. Do not edit below this line.=-...
CVE-2026-48891
creationtimestamp| type| source ---|---|--- 2026-07-07 11:48:56+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mq2jwvygdg2y 2026-07-07 12:11:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2l747p7b2y...
PYSEC-2026-1875 rockhopper Buffer Overflow vulnerability
A vulnerability, which was classified as critical, has been found in bwoodsend rockhopper up to 0.1.2. Affected by this issue is the function countrows of the file rockhopper/src/raggedarray.c of the component Binary Parser. The manipulation of the argument raw leads to buffer overflow. Local...