417146 matches found
Security Bulletin: Multiple Vulnerabilities in IBM Bob
Summary Multiple vulnerabilities were addressed in IBM Bob V 2.0.2 Vulnerability Details CVEID:CVE-2026-62389 DESCRIPTION: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as a duplicate of CVE-2026-48779. CWE:CWE-770: Allocation of Resources Without Limi...
CVE-2026-73492
A flaw was found in Loofah, a library used for processing HTML and XML documents. The 'alloweduri?' function, intended to validate Uniform Resource Identifiers URIs, does not correctly identify and reject 'javascript:' or 'vbscript:' URIs when their scheme is obscured by specific HTML-encoded...
CVE-2026-73491
A flaw was found in Loofah. The Loofah::HTML5::Scrub.alloweduri? function fails to properly detect javascript: Uniform Resource Identifiers URIs when their scheme is split or prefixed with HTML5 named whitespace character references, such as or . This vulnerability allows a remote attacker to cra...
CVE-2026-73626
A flaw was found in JupyterLab where a missing 'await' in the PyPIExtensionManager.install function could lead to an allowlist/blocklist enforcement gap. This vulnerability allows direct callers of install to bypass security checks, potentially enabling the installation of unauthorized extensions...
CVE-2026-19836 Webkul Bagisto Backend Customer Detail Feature view authorization
A security flaw has been discovered in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/customers/view of the component Backend Customer Detail Feature. Performing a manipulation of the argument ID results in authorization bypass. The attack may ...
CVE-2026-19836
A security flaw has been discovered in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/customers/view of the component Backend Customer Detail Feature. Performing a manipulation of the argument ID results in authorization bypass. The attack may ...
EUVD-2026-58682
A security flaw has been discovered in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/customers/view of the component Backend Customer Detail Feature. Performing a manipulation of the argument ID results in authorization bypass. The attack may ...
CVE-2026-73651
A flaw was found in TypeORM. TypeORM's migration:generate command, used for generating database migrations, embeds database schema metadata into JavaScript or TypeScript template literals. This process incorrectly escapes backticks but fails to escape interpolation, creating a vulnerability. An...
CVE-2026-73295
A flaw was found in Material for MkDocs. A DOM-based Cross-Site Scripting XSS vulnerability exists in the search suggestion feature. A remote attacker could exploit this by crafting a malicious URL with a specially designed query parameter. After user interaction, this could lead to the execution...
CVE-2026-73625
A flaw was found in GitPython. Attackers can bypass the checkunsafeoptions guard by smuggling git options within single-character keyword argument kwarg values. This allows them to supply specially crafted option dictionaries to various GitPython methods, such as clonefrom or fetch, leading to...
CVE-2026-73627
A flaw was found in JupyterLab. An authenticated user can bypass administrator lock rules in the plugin manager by making direct requests to the /lab/api/plugins endpoint. This allows them to enable or disable plugins that were locked, including child plugins and those locked via the 'lock all'...
CVE-2026-73643
A flaw was found in js-yaml, a JavaScript YAML parser. A remote attacker could exploit this vulnerability by providing specially crafted YAML input containing nested flow collections. This can lead to exponential parsing time when the application processes untrusted input, consuming excessive CPU...
CVE-2026-73416
A flaw was found in jupyterlab. The PyPI Python Package Index extension manager uses a custom normalization process for package names that is weaker than the official PyPI canonicalization. This allows an authenticated user to bypass blocklist restrictions by using an alternative spelling of a...
CVE-2026-19834 Webkul Bagisto Admin Customer Impersonation Feature login-as-customer authorization
A vulnerability was determined in Webkul Bagisto up to 2.4.4. Affected is an unknown function of the file /admin/customers/login-as-customer/ of the component Admin Customer Impersonation Feature. This manipulation of the argument ID causes authorization bypass. The attack can be initiated...
CVE-2026-19834
A vulnerability was determined in Webkul Bagisto up to 2.4.4. Affected is an unknown function of the file /admin/customers/login-as-customer/ of the component Admin Customer Impersonation Feature. This manipulation of the argument ID causes authorization bypass. The attack can be initiated...
EUVD-2026-58671
A vulnerability was determined in Webkul Bagisto up to 2.4.4. Affected is an unknown function of the file /admin/customers/login-as-customer/ of the component Admin Customer Impersonation Feature. This manipulation of the argument ID causes authorization bypass. The attack can be initiated...
CVE-2026-19834
Technical details about CVE-2026-19834 are not publicly available in the provided documents. Based on the supplied sources, only high-level description is given; no verified affected versions, vulnerable components, exploit specifics, or remediation steps are included. Monitor for updates.
Wordfence Intelligence Weekly WordPress Vulnerability Report (August 3, 2026 to August 9, 2026)
Last week, there were 247 vulnerabilities disclosed in 195 WordPress Plugins and 2 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 135 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...
