Infinite Loop

pypdf is vulnerable to Infinite Loop. The vulnerability is due to the library's handling of circular /Prev entries in cross-reference streams, where an attacker can craft a PDF that leads to an infinite loop when read, allowing for a denial of service attack...

Remote Code Execution (RCE)

mchange-commons-java is vulnerable to Remote Code Execution RCE. The vulnerability is due to its independent JNDI dereferencing implementation allowing remote factoryClassLocation values, which can cause the application to download and execute attacker-controlled code when processing a malicious...

MINI-FQH6-G7W5-G25C

Bulletin has no description...

MINI-CWR2-MV4X-6X4P

Bulletin has no description...

MINI-CV6M-52FQ-Q4JV

Bulletin has no description...

MINI-8X5M-8CXM-XF37

Bulletin has no description...

MINI-5HGM-33RV-94XW

Bulletin has no description...

CVE-2026-28351

creationtimestamp| type| source ---|---|--- 2026-02-27 23:22:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfuu3dkef724 2026-02-28 07:10:10+00:00| seen| https://gist.github.com/alon710/8c701e4c3b2c6c36535c668dab067b3c 2026-02-28 07:29:32+00:00| seen|...

GHSA-7JX5-9FJG-HP4M

creationtimestamp| type| source ---|---|--- 2026-02-27 23:10:11+00:00| seen| https://gist.github.com/alon710/0dcef91400c9361c9eb058c2c8a6df3b...

CVE-2026-26973

Discourse is an open source discussion platform. Versions prior to 2025.12.2, 2026.1.1, and 2026.2.0 have an IDOR Insecure Direct Object Reference in ReviewableNotesController. When enablecategorygroupmoderation is enabled, a user belonging to a category moderation group can create or delete thei...

CVE-2026-25147 OpenEMR's Portal Payment Endpoint Trusts User-Controlled pid

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, in portal/portalpayment.php, the patient id used for the page is taken from the request $pid = $REQUEST'pid' ?? $pid and $pid = $REQUEST'hiddenpatientcode' ?? null 0 ?...

EUVD-2026-9036

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, in portal/portalpayment.php, the patient id used for the page is taken from the request $pid = $REQUEST'pid' ?? $pid and $pid = $REQUEST'hiddenpatientcode' ?? null 0 ?...

CVE-2026-26937

creationtimestamp| type| source ---|---|--- 2026-02-27 14:10:21+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mftva4kls32b...

GHSA-XF68-8HJW-7MPM

creationtimestamp| type| source ---|---|--- 2026-02-27 06:40:19+00:00| seen| https://gist.github.com/alon710/77f29ca3c69eb8ef713507cb5ca27a63...

EUVD-2026-8995

The WP Recipe Maker plugin for WordPress is vulnerable to an Insecure Direct Object Reference IDOR in versions up to, and including, 10.3.2. This is due to the /wp-json/wp-recipe-maker/v1/integrations/instacart REST API endpoint's permissioncallback being set to returntrue and a lack of subsequen...

CVE-2026-1558

The WP Recipe Maker plugin for WordPress is vulnerable to an Insecure Direct Object Reference IDOR in versions up to, and including, 10.3.2. This is due to the /wp-json/wp-recipe-maker/v1/integrations/instacart REST API endpoint's permissioncallback being set to returntrue and a lack of subsequen...

CVE-2026-1558 WP Recipe Maker <= 10.3.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Metadata Modification via 'recipeId' Parameter

The WP Recipe Maker plugin for WordPress is vulnerable to an Insecure Direct Object Reference IDOR in versions up to, and including, 10.3.2. This is due to the /wp-json/wp-recipe-maker/v1/integrations/instacart REST API endpoint's permissioncallback being set to returntrue and a lack of subsequen...

CVE-2026-1558

Summary of CVE-2026-1558 (WP Recipe Maker

CVE-2026-2356

The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.2 via the 'registermember' function, due to missing validation on the 'memberid' user...

CLEANSTART-2026-NY12442 node-tar is a full-featured Tar for Node

Multiple security vulnerabilities affect the npm package. node-tar is a full-featured Tar for Node. See references for individual vulnerability details...