1810 matches found
PT-2026-37157
Name of the Vulnerable Software and Affected Versions Flarum versions prior to 1.8.16 Flarum versions prior to 2.0.0-rc.1 Description An authenticated administrator can inject an arbitrary @import directive into the compiled forum.css file. This occurs because settings registered as LESS config...
CVE-2026-40890 github.com/gomarkdown/markdown: Out-of-bounds Read in SmartypantsRenderer
The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Processing a malformed input containing a character anywhere in the remaining text with a SmartypantsRenderer will lead to Out of Bounds read or a panic. This vulnerability is fixed with...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization in the handling of CSS preprocessor files. An attacker can access arbitrary files from the server by leveraging the import functionality in .less, .sass, or .scss files, even when cms.safemode is enabled. This is...
CVE-2026-26067 October: Safe Mode Bypass via CSS Preprocessor Compilers
October is a Content Management System CMS and web platform. Prior to 3.7.14 and 4.1.10, a server-side information disclosure vulnerability was identified in the handling of CSS preprocessor files. Backend users with Editor permissions could craft .less, .sass, or .scss files that leverage the...
CVE-2026-40164 affecting package jq for versions less than 1.7.1-5
CVE-2026-40164 affecting package jq for versions less than 1.7.1-5. A patched version of the package is available...
PT-2026-34002
October is a Content Management System CMS and web platform. Prior to 3.7.14 and 4.1.10, a server-side information disclosure vulnerability was identified in the handling of CSS preprocessor files. Backend users with Editor permissions could craft .less, .sass, or .scss files that leverage the...
WordPress WowShipping Pro plugin < 1.0.8 - Backdoor vulnerability
Backdoor vulnerability discovered by ? in WordPress Plugin WowShipping Pro versions 1.0.8...
CVE-2026-23228 affecting package kernel for versions less than 5.15.202.1-1
CVE-2026-23228 affecting package kernel for versions less than 5.15.202.1-1. An upgraded version of the package is available that resolves this issue...
PT-2026-33236
Name of the Vulnerable Software and Affected Versions github.com/gomarkdown/markdown affected versions not specified Description Processing malformed input containing a character anywhere in the remaining text using a SmartypantsRenderer can lead to an Out of Bounds read or a panic. This occurs...
Use of Less Trusted Source
Overview Affected versions of this package are vulnerable to Use of Less Trusted Source via the nspawn process. An attacker can gain unauthorized access to the host system by supplying a crafted optional configuration file. Remediation A fix was pushed into the master branch but not yet published...
CVE-2026-39484
CVE-2026-39484 is a URL redirection to an untrusted site (open redirect) vulnerability in the WordPress plugin Hide My WP Ghost . Affected: Hide My WP Ghost product for WordPress, versions from n/a through
Unity Linux 20.1050e Security Update: kernel (UTSA-2026-006573)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006573 advisory. In the Linux kernel, the following vulnerability has been resolved: drivers: base: Free devm resources when unregistering a device In the current code,...
ROOT-OS-ALPINE-320-CVE-2024-32487 CVE-2024-32487 in rootio-less - Patched by Root
Root has patched CVE-2024-32487 in the rootio-less package for Root:Alpine:3.20. Multiple fixed versions available...
OpenClaw's Trusted-proxy Control UI sessions retain privileged scopes without device identity on device-less allow paths
Summary Trusted-proxy Control UI sessions without device identity could retain self-declared privileged scopes on the device-less allow path. Affected Packages / Versions - Package: openclaw npm - Affected: = 2026.3.22 - Latest released tag checked: v2026.3.23-2...
EUVD-2026-15864
Deserialization of Untrusted Data vulnerability in Edge-Themes Kamperen kamperen allows Object Injection.This issue affects Kamperen: from n/a through 1.3...
CVE-2026-25358
The CVE-2026-25358 entry covers a PHP object-injection vulnerability in the WordPress Meloo theme, affecting Meloo versions prior to 2.8.2. Root cause: deserialization of untrusted data could lead to object injection. Impact as stated includes high confidentiality, integrity, and availability con...
PT-2026-27915
Name of the Vulnerable Software and Affected Versions skygroup Reebox versions prior to 1.4.8 Description The software contains a flaw due to improper neutralization of input during web page generation, leading to a Reflected Cross-site Scripting XSS condition. This allows for the injection of...
PT-2026-27889
Name of the Vulnerable Software and Affected Versions Goldish versions prior to 3.47 Description An issue exists in Goldish that allows for object injection due to deserialization of untrusted data. Recommendations Update Goldish to version 3.47 or later...
CVE-2026-4687
Sandbox escape due to incorrect boundary conditions in the Telemetry component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9...