27452 matches found
CVE-2026-66008 Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages
Parse Server versions = 9.0.0 before 9.10.0-alpha.6 and = 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled graphQLPublicIntrospection: false, the default. Because these...
OESA-2026-3145 perl security update
Perl 5 is a highly capable, feature-rich programming language with over 30 years of development. Perl 5 runs on over 100 platforms from portables to mainframes and is suitable for both rapid prototyping and large scale development projects. Security Fixes: Perl versions through 5.43.9 produce...
SUSE CVE-2026-39879
Due to a missing sanitization call in afsqlddrunquery, syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured. Fixes are in syslog-ng 4.12, syslog-ng Premium Edition 8.2 and...
[SECURITY] Fedora 44 Update: python-lsp-black-2.0.0-17.fc44
lsp-black is a python-lsp-server plugin that adds support to black autoformatter. This is forked from pyls-black to be compatible wth community maintained language-server python-lsp-server...
The vulnerability of the Oracle WebLogic Server application server’s kernel allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerability of the Oracle WebLogic Server application server’s kernel is related to deficiencies in the authentication process. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of the protected information using the SAML protoc...
CVE-2026-16353
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Invalid pointer in the DOM: Bindings WebIDL component...
[SECURITY] [DSA 6399-1] wordpress security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6399-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 23, 2026 https://www.debian.org/security/faq -...
CVE-2026-15981
The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. This is due to the mosamlvalidatesignature function performing a loose boolean check on the raw tri-state integer returned by PHP's opensslverify, causing a...
CVE-2026-15981
The CVE describes an unauthenticated authentication bypass in the WordPress SAML SSO Login plugin up to version 5.4.4. The root cause is mo_saml_validate_signature() evaluating the OpenSSL verify result (-1) as truthy due to a loose boolean check on the value returned by PHP openssl_verify(). Thi...
CVE-2026-65699
AgentGPT through 1.0.0 contains an authorization bypass through user-controlled key vulnerability that allows authenticated users to attach tasks to another user's agent run by supplying a target runid in the request body without ownership verification. The AgentCRUD.createtask and...
CVE-2026-65699
AgentGPT through 1.0.0 contains an authorization bypass through user-controlled key vulnerability that allows authenticated users to attach tasks to another user's agent run by supplying a target runid in the request body without ownership verification. The AgentCRUD.createtask and...
CVE-2026-65761
Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improper validation of order parameters lead to an unauthenticated SQL injection in easystore, allowing full DB read access including credentials and sessions...
EUVD-2026-48303
Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window...
CVE-2026-15615
Technical details about CVE-2026-15615 are not publicly available in the provided connected documents. Monitor for updates.
PYSEC-2026-3498 PocketSphinx: Buffer overflows in language and acoustic model loading code
Impact The trie language model code introduced in PocketSphinx 5prealpha failed to check various boundary conditions when reading the headers of ARPA, DMP, and binary format language model files. In the case of invalid, corrupted or malicious input files, this could lead to stack and heap buffer...
CVE-2026-65451
CVE-2026-65451 concerns the WordPress MapSVG plugin, affecting versions <= 8.14.0, with a SQL Injection vulnerability. The connected records specify that this is a contributor SQL injection in MapSVG
EUVD-2026-48215
Contributor SQL Injection in MapSVG = 8.14.0 versions...
EUVD-2026-48208
Unauthenticated SQL Injection in TrueBooker = 1.2.3 versions...