2937743 matches found
CVE-2026-50986
PrestaShop module, totadministrativemandate 1.8.1 is vulnerable to Cross Site Request Forgery CSRF. The payment validation controller has no CSRF token. An attacker can confirm an order in an awaiting status by hijacking a link...
CVE-2026-68771 ComfyUI 0.23.0 Unauthenticated RCE via LoadTrainingDataset Pickle Deserialization
ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitrary Python code by uploading a crafted pickle file and triggering its deserialization. Attackers can upload a malicious shard.pkl file via...
CVE-2026-68771
Technical details about this CVE are not publicly available in the provided documents. Monitor for updates from the vendor and CVE databases for affected versions, impact, and remediation.
CVE-2026-68771
ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitrary Python code by uploading a crafted pickle file and triggering its deserialization. Attackers can upload a malicious shard.pkl file via...
CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft
In this article 1. The CaptiveCrunch campaign 2. Storm-2945 and Midnight Blizzard 3. CaptiveCrunch tradecraft and tooling 4. How to protect against CaptiveCrunch activity 5. Microsoft Defender detections and hunting guidance 6. Indicators of compromise Since early May 2026, Microsoft Threat...
CVE-2026-68770 sentence-transformers Arbitrary Code Execution on Local Model Load Despite trust_remote_code=False
sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the importmoduleclass helper within sentencetransformers/util/misc.py, where the guard condition includes an 'or...
EUVD-2026-51650
sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the importmoduleclass helper within sentencetransformers/util/misc.py, where the guard condition includes an 'or...
CVE-2026-68770
The CVE affects the sentence-transformers library, where a logic flaw in the import_module_class helper (sentence_transformers/util/misc.py) adds an incorrect guard: os.path.exists(model_name_or_path) causes the trust_remote_code gate to pass whenever the provided path exists locally. This enable...
CVE-2026-68770
sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the importmoduleclass helper within sentencetransformers/util/misc.py, where the guard condition includes an 'or...
DEBIAN-CVE-2026-53504
Bulletin has no description...
DEBIAN-CVE-2026-64607
Bulletin has no description...
DEBIAN-CVE-2026-53500
Bulletin has no description...
DEBIAN-CVE-2026-53505
Bulletin has no description...
DEBIAN-CVE-2026-53501
Bulletin has no description...
DEBIAN-CVE-2026-53503
Bulletin has no description...
DEBIAN-CVE-2026-53502
Bulletin has no description...
GHSA-395F-4HP3-45GV vulnerabilities
Vulnerabilities for packages: code-server...
CVE-2026-13311 vulnerabilities
Vulnerabilities for packages: code-server...
Wordfence Bug Bounty Program Monthly Report – April 2026
In April 2026, the Wordfence Bug Bounty Program received 1288 vulnerability submissions from our growing community of security researchers working to improve the overall security posture of the WordPress ecosystem. These submissions are reviewed, triaged, and processed by the Wordfence Threat...
CVE-2026-53510
Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .alloperations interpolates attacker-controlled WSDL operation names into Ruby source passed to moduleeval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2...