CVE-2026-78944 vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-11817

In multi-organization deployments, an Org Admin in one organization could call GET /api/access-control/users/permissions/search with actionPrefix=dashboards: and obtain dashboard and folder UIDs plus per-user permission mappings from other organizations. Single-organization deployments are not...

PT-2026-85512

Snipe-IT versions before 8.6.2 contain an authorization bypass vulnerability in checkout-acceptance report actions when Full Multiple Company Support is enabled. Authenticated users with reports.view permission can enumerate sequential acceptance IDs and soft-delete or trigger reminder emails for...

The vulnerability of the AppAuthentication::verifyCode() method in the packages/panels/src/Auth/MultiFactor/App/AppAuthentication.php file of the component set for the accelerated development of the Filament PHP framework Laravel allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the AppAuthentication::verifyCode method in the packages/panels/src/Auth/MultiFactor/App/AppAuthentication.php file of the Filament PHP framework’s Laravel set is related to the possibility of bypassing the authentication process. Exploiting this vulnerability could allow an...

PT-2026-85497

Traefik before v2.11.55 contains a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass client-certificate authentication by creating conflicting TLS options on multi-host routers. Attackers can reach protected backends by exploiting shared TLS resolution...

CLSA-2026-1788474736 TuxCare security update for 206 packages (5 CVEs)

TuxCare rebuilt 206 packages to address 5 CVEs. Fixed in 3.5.11-tuxcare.9...

multi-juicer v10.3.1

Running CTFs and Security Trainings with OWASP Juice Shop is usually quite tricky, Juice Shop just isn't intended to be used by multiple users at a time. Instructing everybody how to start Juice Shop on their own machine works ok, but takes away too much valuable time. MultiJuicer gives you the...

CVE-2026-85389

Worklenz before 3.0.0 suffers from an authorization bypass on task-scoped API endpoints due to missing verification of task ownership by organization. Authenticated users can query task endpoints with arbitrary task UUIDs to retrieve work logs, comments, attachments, and project insights belongin...

CVE-2026-85389 Worklenz before 3.0.0 Authorization Bypass on Task-Scoped Endpoints

Worklenz before 3.0.0 fails to verify task ownership by organization when resolving task-scoped API endpoints, allowing authenticated users to access another tenant's task data. Attackers can query task endpoints with arbitrary task UUIDs to retrieve work logs, comments, attachments, and project...

CVE-2026-85388 Worklenz through 3.0.0 SQL Injection via the sort-field Query Parameter

Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY clauses. Attackers can use time-based and boolean-based blind SQL injection techniques to extract...

CVE-2026-85388 Worklenz through 3.0.0 SQL Injection via the sort-field Query Parameter

Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY clauses. Attackers can use time-based and boolean-based blind SQL injection techniques to extract...

wrongsecrets-binaries v0.3.0

wrongsecrets-binaries This is a supportive repository for OWASP WrongSecrets. Here we create our binaries which are included in the official project. Want to add a challenge related to secrets hiding in binary? Open a ticket at WrongSecrets issues. Want to fix something you found in one of the...

safer-dependencies v0.6.1

Safer Dependencies for Claude Code When AI coding assistants like Claude add packages to your project, they often pick whatever version sounds right — without checking whether it has known security vulnerabilities, whether the package is still actively maintained, or whether the name is a typo aw...

CVE-2026-84964 Heap corruption via OCSP request double free from crafted multi-URL certificate in TLS client

A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already trusts. During the handshake, specially formed certificate data can cause the same heap object to be released twice. An unauthenticated part...

CVE-2026-78676

GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated...

CVE-2026-84831

SEPPmail Secure Email Gateway before 15.0.7 creates a fully privileged session before required multi-factor authentication enrollment is completed. An attacker with the password for an MFA-required but unenrolled account can access protected functionality without providing a second factor...

CLSA-2026-1788437939 TuxCare security update for django (5 CVEs)

TuxCare rebuilt django to address 5 CVEs. Fixed in 5.0.post10+tuxcare...

Resource Exhaustion

Spring Batch is vulnerable to resource exhaustion. The vulnerability is due to the way FlatFileItemReader assembles multi-line records, where a specially crafted input file can cause excessive CPU consumption and memory usage, leading the batch job to stall or run out of memory...

vigolium v0.4.4

Vigolium - High-fidelity vulnerability scanner fusing agentic AI with native speed, modularity, and precision Vigolium provides two complementary scanning modes: Native Scan vigolium scan: Fast, powerful, and flexible. Deterministic, multi-phase scanning with 317 modules across content discovery,...

EUVD-2026-70363

SEPPmail Secure Email Gateway before 15.0.7 creates a fully privileged session before required multi-factor authentication enrollment is completed. An attacker with the password for an MFA-required but unenrolled account can access protected functionality without providing a second factor...