8120 matches found
PT-2026-67421
XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID. get signed xml in lib/XML/Sig.pm, called from verify, resolves the SignedInfo Reference/@URI to a node with the XPath expression "//@ID='$id'" and returns the first node of the resulting node set. A document in whic...
CVE-2026-16291
The ProfileGrid WordPress plugin before 5.9.9.8 does not verify that a notification belongs to the requesting user before deleting it, allowing any authenticated user such as a Subscriber to delete other users' notifications by enumerating notification identifiers...
CVE-2026-16291
The ProfileGrid WordPress plugin before 5.9.9.8 does not verify that a notification belongs to the requesting user before deleting it, allowing any authenticated user such as a Subscriber to delete other users' notifications by enumerating notification identifiers...
Debian dsa-6410 : libssh-4 - security update
The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6410 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6410-1 [email protected] https://www.debian.org/securit...
CVE-2026-15244
creationtimestamp| type| source ---|---|--- 2026-08-01 14:55:48+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrzq2437k52v 2026-08-01 14:56:18+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mrzq2ydcbl2j 2026-08-01 15:29:04+00:00| seen|...
CVE-2026-67330
@better-auth/scim a better-auth plugin versions = 1.4.0-beta.27 through = 1.7.0-beta.0 through = 1.7.0-beta.9 contain an authorization bypass. SCIM token issuance did not reject provider IDs already used by existing SSO, SAML, OIDC, generic OAuth, or social account providers, and the same logical...
OESA-2026-3193 python-urwid security update
Urwid is a console user interface library for Python. It includes many features useful for text console application developers Security Fixes: The urwid web display backend urwid/display/web.py generates web session identifiers urwidid in Screen.start by concatenating two random.randrange109 call...
[SECURITY] [DLA 4710-1] chromium security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-4710-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort August 01, 2026 https://wiki.debian.org/LTS -...
[SECURITY] [DSA 6408-1] chromium security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6408-1 [email protected] https://www.debian.org/security/ Andres Salomon July 31, 2026 https://www.debian.org/security/faq -...
SUSE CVE-2026-64611
A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel function enters an infinite loop when processing a printer-advertised IEEE-1284 device ID with an empty model field, causing sustained CPU consumption. A network-adjacent attacker could exploit this by broadcasting a specially...
CVE-2026-67355: Insertion of Sensitive Information Into Sent Data
guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as host-only. Attackers controlling child hosts can receive host-only cookies intended only for parent hosts, potentially disclosing session...
CVE-2026-55100
hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values including name, username, group, role, and version into Vault request paths and query strings instead of using encodeURIComponent and...
CVE-2026-55100 hashi-vault-js has a path traversal and query parameter injection
hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values including name, username, group, role, and version into Vault request paths and query strings instead of using encodeURIComponent and...
CVE-2026-55100 hashi-vault-js has a path traversal and query parameter injection
hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values including name, username, group, role, and version into Vault request paths and query strings instead of using encodeURIComponent and...
CVE-2026-55100 hashi-vault-js has a path traversal and query parameter injection
hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values including name, username, group, role, and version into Vault request paths and query strings instead of using encodeURIComponent and...
EUVD-2026-51299
Sylius Mollie Plugin vulnerable to payment status forgery via the payment webhook...
CVE-2026-51301
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
CVE-2026-51289
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...