91227 matches found
CVE-2026-66660: Missing Authorization
Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on = 2.5.1 versions...
CVE-2026-66657: Improper Control of Filename for Include/Require Statement in PHP Program
Unauthenticated Local File Inclusion in Biagiotti Core = 2.1.1 versions...
CVE-2026-28188: Missing Authorization
Unauthenticated Broken Access Control in Hydra Booking = 1.2.2 versions...
CVE-2026-19694: Heap-based Buffer Overflow
TTX Logger file parser crash in 4.6.0 to 4.6.7 allows denial of service...
CVE-2026-24791: Incorrect Authorization
Public-only tokens bypass private-resource restrictions on /api/v1/user self routes...
CVE-2026-54481: Improper Certificate Validation
Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override CWE-295...
CVE-2026-55987: Incorrect Authorization
OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens incomplete fix of 38009...
CVE-2026-56755: Improper Access Control
Denial of Service CPU & Memory Exhaustion via ON^2 String Concatenation in Debian Package Upload...
CVE-2026-58440: Improper Access Control
Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content incomplete revocation cleanup in DeleteCollaboration...
CVE-2026-57897: Exposure of Sensitive Information to an Unauthorized Actor
Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs...
CVE-2026-58416: Improper Handling of Insufficient Permissions or Privileges
Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...
CVE-2026-58434: Exposure of Sensitive Information to an Unauthorized Actor
Private Repository Metadata Remains Accessible After Access Revocation...
CVE-2026-66460: Improper Neutralization of Input During Web Page Generation
Subscriber Cross Site Scripting XSS in AfterShip Tracking = 1.18.1 versions...
CVE-2026-19695: Stack-based Buffer Overflow
Gammu DCT3 trace file parser crash in 4.6.0 to 4.6.7 allows denial of service...
CVE-2026-61974: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Mang Board WP = 2.3.4 versions...
CVE-2026-66472: Improper Neutralization of Special Elements used in an SQL Command
Unauthenticated SQL Injection in Everest Backup = 2.3.12 versions...
CVE-2026-66656: Improper Control of Filename for Include/Require Statement in PHP Program
Unauthenticated Local File Inclusion in Foton Core = 1.1.1 versions...
CVE-2026-58437: Improper Access Control
Repository Visibility Manipulation via Git Push Options...