CVE-2026-55228

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, the REST API did not properly enforce the scope of project- and workspace-scoped teams, allowing a user to submit invalid team configurations through the API. By assigning...

CVE-2026-55227 Observable object existence disclosure in private Weblate projects via globally scoped object lookups

Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally scoped manner rather than restricting the lookup to projects the user can access, so they return HTTP 403 Forbidden instead of 404 Not Found when a user requests an object they a...

CVE-2026-32593

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the backend Filter widget is vulnerable to SQL injection through the numberrange scope type when that scope is configured with a conditions key, allowing an authenticated backend...

CVE-2026-32593

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the backend Filter widget is vulnerable to SQL injection through the numberrange scope type when that scope is configured with a conditions key, allowing an authenticated backend...

CVE-2026-32593 Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the backend Filter widget is vulnerable to SQL injection through the numberrange scope type when that scope is configured with a conditions key, allowing an authenticated backend...

CVE-2026-32593 Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the backend Filter widget is vulnerable to SQL injection through the numberrange scope type when that scope is configured with a conditions key, allowing an authenticated backend...

EUVD-2026-66640

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the backend Filter widget is vulnerable to SQL injection through the numberrange scope type when that scope is configured with a conditions key, allowing an authenticated backend...

CVE-2026-32593 Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the backend Filter widget is vulnerable to SQL injection through the numberrange scope type when that scope is configured with a conditions key, allowing an authenticated backend...

CVE-2026-32593

Winter CMS (Laravel-based PHP CMS) versions up to 1.2.12 are vulnerable to SQL injection in the backend Filter widget (Backend\Widgets\Filter) when the numberrange scope type is configured with a conditions key. Filter values are interpolated into the conditions statement without parameter bindin...

CVE-2026-80548

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Selectively expand iomutex The iomutex was defined to serialize the ioregions, but then has also sort of been associated with the I/O themselves because of the close relationship they share. With the handful of race...

BIT-JRE-2026-61308

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12;...

BIT-JAVA-MIN-2026-61308

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12;...

BIT-JAVA-2026-61308

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12;...

CVE-2026-80548

CVE-2026-80548 affects the Linux kernel s390/vfio_ccw subsystem, where the io_mutex lock had a scope too narrow to fully serialize I/O operations, leaving residual race conditions on I/O resources. The fix expands the lock's scope to close these windows and also reworks how cp_free() is invoked f...

CVE-2026-80548 s390/vfio_ccw: Selectively expand io_mutex

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Selectively expand iomutex The iomutex was defined to serialize the ioregions, but then has also sort of been associated with the I/O themselves because of the close relationship they share. With the handful of race...

CVE-2026-80203

The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin on the acting account rather than verifying whether the specific API key carri...

CVE-2026-80204

The Grav API plugin getgrav/grav-plugin-api before 1.0.18 does not apply the API-key scope cap in the injectSecurityTab function of BlueprintController when deciding whether a page's security/permissions blueprint section is editable. Because the function performs raw isSuperAdmin/hasPermission...

CVE-2026-80204

The Grav API plugin getgrav/grav-plugin-api before 1.0.18 does not apply the API-key scope cap in the injectSecurityTab function of BlueprintController when deciding whether a page's security/permissions blueprint section is editable. Because the function performs raw isSuperAdmin/hasPermission...

CVE-2026-80203

The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin on the acting account rather than verifying whether the specific API key carri...

CVE-2026-80203 Grav before 1.0.18 Authentication Bypass via Scoped API Key

The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin on the acting account rather than verifying whether the specific API key carri...