Auth0-PHP 安全特征问题漏洞

Auth0-PHP is an open-source PHP SDK developed by Auth0 for authentication and management of APIs using Auth0. Versions of Auth0-PHP from 8.0.0 to 8.19.0 had security vulnerabilities. These vulnerabilities stemmed from the use of encryption methods with insufficient entropy when handling cookies...

ROOT-OS-ALPINE-319-CVE-2023-5568 CVE-2023-5568 in rootio-samba - Patched by Root

Root has patched CVE-2023-5568 in the rootio-samba package for Root:Alpine:3.19. Multiple fixed versions available...

CVE-2026-31915

Missing Authorization vulnerability in UX-themes Flatsome flatsome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flatsome: from n/a through = 3.19.6...

ROOT-OS-ALPINE-319-CVE-2023-7256 CVE-2023-7256 in rootio-libpcap - Patched by Root

Root has patched CVE-2023-7256 in the rootio-libpcap package for Root:Alpine:3.19. Multiple fixed versions available...

ROOT-OS-ALPINE-319-CVE-2024-32487 CVE-2024-32487 in rootio-less - Patched by Root

Root has patched CVE-2024-32487 in the rootio-less package for Root:Alpine:3.19. Multiple fixed versions available...

CVE-2022-50284

creationtimestamp| type| source ---|---|--- 2026-03-19 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/...

CLSA-2026-1773782865 Update of alt-php

New microcode update packages from upstream up to 2026-02-21: - Addition AMD CPU microcode for processor family 0x19: cpuid:0x00A00F10ver:0x0A00107A, cpuid:0x00A00F11ver:0x0A0011D5, cpuid:0x00A00F11ver:0x0A0011DE, cpuid:0x00A00F12ver:0x0A001238, cpuid:0x00A00F12ver:0x0A001247,...

OESA-2026-1608 activemq security update

The most popular and powerful open source messaging and Integration Patterns server. Security Fixes: A vulnerability classified as problematic has been found in Apache ActiveMQ Application Server Software.CWE is classifying the issue as CWE-190. The product performs a calculation that can produce...

BIT-PARSE-2026-30962 Parse Server has a protected fields bypass via logical query operators

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2 and 8.6.19, the validation for protected fields only checks top-level query keys. By wrapping a query constraint on a protected field inside a logical operator, the check is...

BIT-GHOST-2026-29784 Ghost: Incomplete CSRF protections around OTC use

Ghost is a Node.js content management system. From version 5.101.6 to 6.19.2, incomplete CSRF protections around /session/verify made it possible to use OTCs in login sessions different from the requesting session. In some scenarios this might have made it easier for phishers to take over a Ghost...

OneUptime 安全漏洞

OneUptime is a comprehensive open-source solution developed by OneUptime. It is used to monitor and manage your online services. Versions of OneUptime prior to 10.0.19 contain security vulnerabilities. These vulnerabilities stem from GitHub App callbacks that allow attackers to control parameters...

CVE-2026-30920 OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.19, OneUptime's GitHub App callback trusts attacker-controlled state and installationid values and updates Project.gitHubAppInstallationId with isRoot: true without validating that the caller is authorized for the...

EUVD-2025-208308

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jeroen Schmit Theater for WordPress theatre allows Stored XSS.This issue affects Theater for WordPress: from n/a through = 0.19...

PT-2026-23147

Name of the Vulnerable Software and Affected Versions Theater for WordPress versions prior to 0.19 Description The software contains a flaw due to improper neutralization of input during web page generation, leading to a Cross-site Scripting issue. This allows for Stored XSS attacks...

be.yildiz-games:module-messaging-activemq (>=1.0.0 <=1.0.1), cn.codeforfun:jfinal-activemq (=0.3) +215 more potentially affected by CVE-2025-66168 +1 more via org.apache.activemq:activemq-all (>=5.0.0 <=5.19.1)

org.apache.activemq:activemq-all MAVEN version =5.0.0, =1.0.0, =6.0.03, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.3-rc1, =2.0.0, =3.0.0, =8.0.0, =2.0.0, =1.0.0, =1.0.1, =1.0.2 and more Source cves: CVE-2025-66168, CVE-2026-40046 Source advisory: SNYK:JAVA-ORGAPACHEACTIVEMQ-15426350...

Ghost Vulnerable to Remote Code Execution via Malicious Themes

Impact Specifically crafted malicious themes can execute arbitrary code on the server running Ghost. Vulnerable Versions This vulnerability is present in Ghost v0.7.2 to v6.19.0. Patches v6.19.1 contains a fix for this issue. Workarounds Ghost generally recommends users refrain from installing...

CVE-2026-3282 libvips unpremultiply.c vips_unpremultiply_build out-of-bounds

A flaw has been found in libvips 8.19.0. This vulnerability affects the function vipsunpremultiplybuild of the file libvips/conversion/unpremultiply.c. Executing a manipulation of the argument alphaband can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been...

CVE-2026-3281

The CVE-2026-3281 vulnerability affects libvips 8.19.0, specifically the vips_bandrank_build function in libvips/conversion/bandrank.c. The issue is a heap-based buffer overflow triggered by manipulating the argument index. Attack requires local access, and public exploits exist. A patch is avail...

libvips 安全漏洞

libvips is an open-source fast image processing library with low memory requirements. Version 8.19.0 of libvips contains a security vulnerability, which stems from improper handling of the parameter “index” in the file “libvips/conversion/bandrank.c”. This vulnerability may lead to a heap-based...

CVE-2026-3284

A vulnerability was found in libvips 8.19.0. Impacted is the function vipsextractareabuild of the file libvips/conversion/extract.c. The manipulation of the argument extractarea results in integer overflow. The attack requires a local approach. The exploit has been made public and could be used...