56749 matches found
CVE-2026-44787
Discourse exposes a flaw in signup: before versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a new user could set primary_group_id and gain whisper-group privileges when whispers_allowed_groups is configured. This is fixed in 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5. The CVSS 3.1 base score ...
CVE-2026-44787 Discourse: Signup-time primary_group_id assignment grants whisperer access
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the signup flow could allow newly registered users to set primarygroupid and gain whisper-group privileges without legitimate group membership on sites with whispersallowedgroups configured. This...
CVE-2026-52777
creationtimestamp| type| source ---|---|--- 2026-07-09 21:48:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqame5dcxj25 2026-07-09 22:35:05+00:00| published-proof-of-concept| https://github.com/YesWiki/yeswiki/security/advisories/GHSA-9369-69wj-7m2f...
CVE-2026-55604
DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version 1.7.0, the process-global SessionStore accepts caller-supplied sessionid values without binding them to any authenticated principal or transport session. An attacker can enumerate active session I...
SQL Injection
Overview Affected versions of this package are vulnerable to SQL Injection via the deleteUserReaction process. An attacker can access and manipulate sensitive database information by injecting crafted SQL through the idreaction and id URL path parameters as an authenticated user. Remediation...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via improper handling of the id parameter in the Bazar widget handler. An attacker can execute arbitrary JavaScript in the victim's browser by crafting a malicious URL that injects attacker-controlled attributes...
GHSA-V4HW-Q98X-8JMM vulnerabilities
Vulnerabilities for packages: linux-qemu, linux-gcp, linux-qemu-melange, linux-azure...
GHSA-F2VR-9QRM-HV28 vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-8QP8-73PF-8G22 vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-P24M-96HG-M8M8 vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-J4R2-33QC-JRRJ vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-C53H-XMGP-J2HJ vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-499R-FH8Q-QCFC vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2026-14146 vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-3X3P-QX4R-HMGH vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-XM69-PMF3-JR84 vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2026-14146 vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2026-0275
A local privilege escalation vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated administrator with access to the macOS local filesystem to perform actions on the device with root privileges. This issue only affects Prisma® Browser on macOS...