72413 matches found
Better Auth vulnerable to unauthorized invitation acceptance via unverified email match in organization plugin
Am I affected? Users are affected if all of the following are true: - Their application uses better-auth with the organization plugin import organization from "better-auth/plugins/organization". - Their application enables a sign-up surface that allows arbitrary unverified email registration. Mos...
CVE-2026-44877
creationtimestamp| type| source ---|---|--- 2026-07-07 20:45:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3hwylbp42e 2026-07-07 20:46:45+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mq3hymuqhi2b 2026-07-08 14:15:14+00:00| seen|...
MINI-XMH2-7X8Q-W457
Bulletin has no description...
MINI-79JP-X795-3JP6
Bulletin has no description...
MINI-9P6C-2W3C-2F4C
Bulletin has no description...
CVE-2026-59708 Ghostfolio - Unauthorized Portfolio Data Exposure via Public Endpoint
The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts private access IDs without validating granteeUserId filtering, allowing unauthenticated access to full portfolio data. Attackers with a private access ID can retrieve sensitive portfolio information including holdings,...
CVE-2021-21633
creationtimestamp| type| source ---|---|--- 2026-07-07 17:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq35firqjh25...
CVE-2026-21383
creationtimestamp| type| source ---|---|--- 2026-07-07 16:45:14+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-qualcomm-9 2026-07-16 04:45:55+00:00| seen| https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities20260716...
CVE-2025-12799
CVE-2025-12799 affects Jastow and is described as a Cross-Site Scripting (XSS) vulnerability that arises when a configuration allows unescaped characters in URLs with embedded Undertow and Jastow, indicating improper input handling. The CVSS 3.1 base vector shows a Network attack vector, high aut...
CVE-2026-12948
creationtimestamp| type| source ---|---|--- 2026-07-07 16:18:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2yzanqva24...
CVE-2026-53479
creationtimestamp| type| source ---|---|--- 2026-07-07 16:08:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2yhdqmmp27 2026-07-08 09:00:23+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mq4qyhbjfr2v...
PYSEC-2026-1810 pyasn1 has a DoS vulnerability in decoder
Summary After reviewing pyasn1 v0.6.1 a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets. Details The integer issue can be found in the decoder as reloid += subId 7 + nextSubId,:...
PYSEC-2026-1759 Parsl Monitoring Visualization Vulnerable to SQL Injection
Affected Product: Parsl Python Parallel Scripting Library Component: parsl.monitoring.visualization Vulnerability Type: SQL Injection CWE-89 Severity: High CVSS Rating Recommended: 7.5 - 8.6 URL: https://github.com/Parsl/parsl/blob/master/parsl/monitoring/visualization/views.py Summary A SQL...
PYSEC-2026-1226 Bugsink path traversal via event_id in ingestion
Summary In affected versions, ingestion paths construct file locations directly from untrusted eventid input without validation. A specially crafted eventid can result in paths outside the intended directory, potentially allowing file overwrite or creation in arbitrary locations. Submitting such...
PYSEC-2026-1076 AgentScope stored cross-site scripting (XSS) vulnerability
A stored cross-site scripting XSS vulnerability exists in modelscope/agentscope, as of the latest commit 21161fe on the main branch. The vulnerability occurs in the view for inspecting detailed run information, where a user-controllable string run ID is appended and rendered as HTML. This allows ...
ECHO-3B80-9E26-3298
Bulletin has no description...
MINI-GQWV-9RFJ-R275
Bulletin has no description...
MINI-C9H2-C888-858R
Bulletin has no description...