75733 matches found
CVE-2026-45738
CVE-2026-45738 : Argo CD contains a Stored XSS in link.argocd.argoproj.io/* annotations that can be rendered as anchor href values in the Summary tab, enabling javascript: execution for a higher-privileged user in the origin session when there is application write access. This is fixed in Argo CD...
EUVD-2026-44789
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, and 3.4.2, Argo CD users with application write access can set link.argocd.argoproj.io/ annotations whose pipe-separated values are rendered by...
CVE-2026-45738 Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, and 3.4.2, Argo CD users with application write access can set link.argocd.argoproj.io/ annotations whose pipe-separated values are rendered by...
CVE-2026-45738 Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, and 3.4.2, Argo CD users with application write access can set link.argocd.argoproj.io/ annotations whose pipe-separated values are rendered by...
CVE-2026-45738 Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, and 3.4.2, Argo CD users with application write access can set link.argocd.argoproj.io/ annotations whose pipe-separated values are rendered by...
CVE-2026-50552
creationtimestamp| type| source ---|---|--- 2026-07-15 19:31:25+00:00| seen| https://gist.github.com/alon710/0bc2e259381309bd98ca630012fce3cb 2026-07-15 20:35:05+00:00| published-proof-of-concept| https://github.com/koel/koel/security/advisories/GHSA-jr4p-4xjh-fwvw...
CVE-2026-12382
creationtimestamp| type| source ---|---|--- 2026-07-15 19:06:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpg52amuh22...
GHSA-36QX-FR4F-26G5
creationtimestamp| type| source ---|---|--- 2026-07-15 19:00:46+00:00| seen| https://gist.github.com/rodrigo-arias/52b0854a2e57501b04c4c8d6728a34ea...
CVE-2026-12997
Summary of CVE-2026-12997 : The Gravity Forms plugin for WordPress is vulnerable to a Directory Traversal flaw in all versions up to and including 2.10.4, exploitable via the gform_uploaded_files parameter. An unauthenticated attacker can read arbitrary server files containing sensitive informati...
CVE-2026-54443
Dashy is a self-hostable personal dashboard. From 1.9.4 until 3.2.0, the Dashy RSS Widget in src/components/Widgets/RssFeed.vue does not sanitize RSS item link values before rendering feed item titles and Read More links as anchor href attributes, allowing an attacker-controlled feed to provide a...
EUVD-2026-44760
Dashy is a self-hostable personal dashboard. From 1.9.4 until 3.2.0, the Dashy RSS Widget in src/components/Widgets/RssFeed.vue does not sanitize RSS item link values before rendering feed item titles and Read More links as anchor href attributes, allowing an attacker-controlled feed to provide a...
CVE-2026-47156
creationtimestamp| type| source ---|---|--- 2026-07-15 17:44:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqpbjdjpio2a...
MGASA-2026-0254 Updated python-mistune package fixes security vulnerabilities
The updated python-mistune package fixes two security vulnerablities: Prior to 3.2.1, rendertocul builds a table-of-contents tree from a list of level, id, text tuples. Both the id value used as href="" and the text value used as the visible link label are inserted into tags via a plain Python...
CVE-2026-61644
creationtimestamp| type| source ---|---|--- 2026-07-15 17:22:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpacpd3na2m...
CVE-2026-54563
creationtimestamp| type| source ---|---|--- 2026-07-15 17:17:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqp7zq7njw22 2026-08-26 16:35:10+00:00| published-proof-of-concept| https://github.com/cloudreve/cloudreve/security/advisories/GHSA-w5fv-7x5q-g8qp...
CVE-2026-53516 Better Auth: Account takeover via OAuth auto-link to unverified pre-registered email
Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, Better Auth's OAuth callback auto-link gate in handleOAuthUserInfo accepts implicit account linking when the OAuth provider asserts emailverified: true without requiring the local user row's emailVerified...
CVE-2026-53516 Better Auth: Account takeover via OAuth auto-link to unverified pre-registered email
Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, Better Auth's OAuth callback auto-link gate in handleOAuthUserInfo accepts implicit account linking when the OAuth provider asserts emailverified: true without requiring the local user row's emailVerified...
CVE-2026-53516 Better Auth: Account takeover via OAuth auto-link to unverified pre-registered email
Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, Better Auth's OAuth callback auto-link gate in handleOAuthUserInfo accepts implicit account linking when the OAuth provider asserts emailverified: true without requiring the local user row's emailVerified...
CVE-2026-53516
Summary: CVE-2026-53516 affects Better Auth (
CVE-2026-20150
creationtimestamp| type| source ---|---|--- 2026-07-15 17:11:14+00:00| seen| https://infosec.exchange/users/AAKL/statuses/116925102408110334 2026-07-15 19:01:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpftydweo22 2026-07-16 13:00:29+00:00| seen|...