75552 matches found
CVE-2026-12877
creationtimestamp| type| source ---|---|--- 2026-07-24 20:12:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrg5ycdv322u 2026-07-25 10:00:42+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrhmbx6swj2g...
CVE-2026-57530 Milkdown < 7.21.3 Stored XSS via javascript: URL in link href
Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-commonmark and @milkdown/components packages that allows attackers with document write access to execute arbitrary JavaScript in the browser context of any user who opens the document or clicks a...
CVE-2026-57530
Milkdown (versions
CVE-2026-57530 Milkdown < 7.21.3 Stored XSS via javascript: URL in link href
Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-commonmark and @milkdown/components packages that allows attackers with document write access to execute arbitrary JavaScript in the browser context of any user who opens the document or clicks a...
CVE-2026-66033
creationtimestamp| type| source ---|---|--- 2026-07-24 18:00:51+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrfwnm4cej2w 2026-07-27 16:45:09+00:00| seen| https://www.acn.gov.it/portale/w/vulnerabilita-in-libssh2-1 2026-07-31 08:07:07+00:00| seen|...
CVE-2026-66032
creationtimestamp| type| source ---|---|--- 2026-07-24 18:00:44+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrfwnfsncy2m 2026-07-26 06:42:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrjrnp5d672a 2026-07-27 09:06:04+00:00| seen|...
CVE-2026-65710
sysPass through version 3.2.11 contains a missing authorization vulnerability that allows authenticated users with the PUBLICLINKCREATE profile flag to trigger unauthorized decryption and persistent storage of any vault account's password by exploiting the absence of AccountAcl checks in the publ...
CVE-2026-64225
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: CGX: add bounds check to cgxspeedmbps index cgxspeedmbps has 13 elements but RESPLINKSTATSPEED can yield values 0-15. If it returns a value = 13, this causes an out-of-bounds array access. Add a bounds check and...
DEBIAN-CVE-2026-64223
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: consume only present negotiated TTLM maps ieee80211tidtolinkmapsizeok validates negotiated TTLM elements against the number of link-map entries indicated by linkmappresence. ieee80211parsenegttlm must consume the...
DEBIAN-CVE-2026-64219
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate payload length and linkindex in dcprocessdmubauxtransferasync Why&How dcprocessdmubauxtransferasync copies payload-length bytes into a 16-byte stack buffer dpaux.data16 guarded only by an ASSERT, which i...
CVE-2026-64219
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate payload length and linkindex in dcprocessdmubauxtransferasync Why&How dcprocessdmubauxtransferasync copies payload-length bytes into a 16-byte stack buffer dpaux.data16 guarded only by an ASSERT, which i...
CVE-2026-64212
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it In iwlmldremovelink, the link-fwid is saved at the beginning of the function so we have it after we freed the link. But the link pointer can be NULL, and is...
UBUNTU-CVE-2026-64255
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: validate stamask before ffs in BA session handlers Three BA session handlers use ffsbadata-stamask - 1 to derive a station ID without checking that stamask is non-zero. When stamask is zero, ffs returns 0 and...
CVE-2026-65710
SysPass 3.2.11 is affected by a missing authorization vulnerability in the PublicLink flow. Authenticated users with the PUBLICLINK_CREATE profile flag can trigger unauthorized decryption and persistence of vault passwords by abusing the absence of AccountAcl checks in the public link creation pa...
CVE-2026-65710 sysPass 3.2.11 Missing Authorization via PublicLinkController Account Decryption
sysPass through version 3.2.11 contains a missing authorization vulnerability that allows authenticated users with the PUBLICLINKCREATE profile flag to trigger unauthorized decryption and persistent storage of any vault account's password by exploiting the absence of AccountAcl checks in the publ...
CVE-2026-65710 sysPass 3.2.11 Missing Authorization via PublicLinkController Account Decryption
sysPass through version 3.2.11 contains a missing authorization vulnerability that allows authenticated users with the PUBLICLINKCREATE profile flag to trigger unauthorized decryption and persistent storage of any vault account's password by exploiting the absence of AccountAcl checks in the publ...
EUVD-2026-48716
sysPass through version 3.2.11 contains a missing authorization vulnerability that allows authenticated users with the PUBLICLINKCREATE profile flag to trigger unauthorized decryption and persistent storage of any vault account's password by exploiting the absence of AccountAcl checks in the publ...
CVE-2026-65710 sysPass 3.2.11 Missing Authorization via PublicLinkController Account Decryption
sysPass through version 3.2.11 contains a missing authorization vulnerability that allows authenticated users with the PUBLICLINKCREATE profile flag to trigger unauthorized decryption and persistent storage of any vault account's password by exploiting the absence of AccountAcl checks in the publ...
CVE-2026-65710
sysPass through version 3.2.11 contains a missing authorization vulnerability that allows authenticated users with the PUBLICLINKCREATE profile flag to trigger unauthorized decryption and persistent storage of any vault account's password by exploiting the absence of AccountAcl checks in the publ...
Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in
Am I affected You are affected if all of the following hold: - You run a better-auth version below 1.6.22, or a 1.7.0-beta below 1.7.0-beta.10. - You enable the magic-link plugin or the email-OTP plugin. - You also enable email and password sign-up with open registration. - An account can exist a...