84354 matches found
CVE-2026-53445
Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan copyBoard Meteor DDP method in server/publications/boards.js copies a board by caller-supplied board ID without checking this.userId, membership, or admin access. Any authenticated user can copy a private board they are not a...
CVE-2026-38974
Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramikovendor.py...
CGA-896X-QCJC-7CVJ
Bulletin has no description...
CGA-VRFM-2MXJ-RRQM
Bulletin has no description...
CGA-5FFG-QVXM-2MQ2
Bulletin has no description...
CGA-V2RG-WWFX-2RQQ
Bulletin has no description...
CGA-2Q7M-342J-5XJF
Bulletin has no description...
CGA-XPMW-F67Q-22QQ
Bulletin has no description...
GHSA-XGCH-X3MX-CM3C safeurl is Missing IPv6 CIDR Ranges in Blocklist
The privateNetworks blocklist was found to be missing newly added CIDR ranges. More specifically, the following CIDR ranges were not being blocked: - 64:ff9b:1::/48: NAT64 local-use prefix RFC 8215 - 5f00::/16: Segment Routing SRv6 SIDs RFC 9602 - 3fff::/20: documentation prefix RFC 9637 -...
CVE-2026-55445
Qinglong is a timed task management platform supporting Python3, JavaScript, Shell, and Typescript. Prior to 2.20.1, the init guard middleware in back/loaders/express.ts checks /api/user/init but not /open/user/init, while rewrite'/open/', '/api/$1' rewrites the whitelisted /open/ path after JWT...
CVE-2026-52893 Wekan: OIDC Account Takeover via Unconditional Email-Based Account Merge in onCreateUser hook
Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan Accounts.onCreateUser hook in server/models/users.js merges OIDC logins into existing accounts when the OIDC email or username matches an existing Wekan user, without verifying ownership or checking emailverified. An attacker...
CVE-2026-52893 Wekan: OIDC Account Takeover via Unconditional Email-Based Account Merge in onCreateUser hook
Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan Accounts.onCreateUser hook in server/models/users.js merges OIDC logins into existing accounts when the OIDC email or username matches an existing Wekan user, without verifying ownership or checking emailverified. An attacker...
CVE-2026-53444 Wekan: Missing authorization on OIDC Meteor methods allows privilege escalation to admin
Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan OIDC-related Meteor methods in packages/wekan-oidc/oidcserver.js, server/models/org.js, and server/models/team.js are globally callable without the admin authorization checks used by their non-OIDC counterparts. Authenticated use...
Improper Authorization
Apollo Portal is vulnerable to Improper Authorization. The vulnerability is due to missing application and namespace permission checks when retrieving releases by ID, which allows an authenticated low-privileged user to access unauthorized release data by supplying a valid release ID...
DEBIAN-CVE-2026-56135
Bulletin has no description...
DEBIAN-CVE-2026-42617
Bulletin has no description...
DEBIAN-CVE-2026-56136
Bulletin has no description...
MINI-VCPV-VV3W-RW5Q
Bulletin has no description...