18551 matches found
CVE-2026-71433
LangGraph Checkpoint Postgres and SQLite Checkpoint are the Postgres and SQLite implementations of LangGraph's checkpoint saver. Prior to 3.1.1, the langgraph-checkpoint-postgres and langgraph-checkpoint-sqlite packages persisted hierarchical namespaces as a dot joined string and scoped reads by...
CVE-2026-16619
The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on every login, allowing an attacker who already knows a user's password to guess the one-time code...
CVE-2026-61632 PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path
PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. In versions up to and including 10.21.3, the b64 extension is vulnerable to a path traversal that discloses arbitrary files: it inlines images referenced by by joining the src onto the configured basepath with...
crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption
A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security TLS session resumption when certificate authority CA settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing ...
CVE-2026-45378
CVE-2026-45378 affects Decidim where the identity-document verification admin UI embeds verification_attachment blobs using reusable signed Active Storage disk URLs. The implementation renders images with variant_url(...), producing signed /rails/active_storage/disk/... links that bypass authoriz...
CVE-2026-19061 Insta InstaKNXServiceApp Firmware Update CreateWebClientAndDownloadFileList data authenticity
A flaw has been found in Insta InstaKNXServiceApp 1.2.3.1469. Affected by this issue is the function CreateWebClientAndDownloadFileList of the component Firmware Update Handler. Executing a manipulation can lead to insufficient verification of data authenticity. It is possible to launch the attac...
CVE-2026-11361
Formidable Forms for WordPress (before 6.32.1) is affected by CVE-2026-11361 due to improper validation of PayPal subscription status, enabling unauthenticated users to bypass payment and trigger paid actions (content access, license delivery, membership activation) without charges. Impact aligns...
libXfont2: BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow
A flaw was found in libXfont2. In the BitmapScaleBitmaps function, an integer overflow can occur when calculating the memory needed for font glyphs. This overflow leads to a heap buffer overflow, where a smaller-than-required memory buffer is allocated. A local attacker can exploit this by loadin...
CVE-2026-19019
The CVE-2026-19019 entry concerns poco-ai poco-agent (up to 0.5.4) with a vulnerable area in WorkspaceManager._setup_session_persistence within executor/app/core/workspace.py of Claude File Handler. Reported impact is incomplete cleanup, potentially enabling remote abuse. Public disclosure exists...
Linux Distros Unpatched Vulnerability : CVE-2026-64601
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: us144mkii: captureurbcomplete: redundant usbanchorurb corrupts anchor list on each resubmission In captureurbcomplete, usbanchorurb is called on every...
GHSA-QHGP-4M99-FHV7 vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2026-17847 vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2026-17763 vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2026-17926 vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2026-17996 vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2026-17697 vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2026-12872
creationtimestamp| type| source ---|---|--- 2026-08-05 20:14:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msedouqy5w2a...
CVE-2026-70439
Jenkins XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permission checks, allowing attackers lacking appropriate permissions to invoke the conversion functionality...
keycloak-services: keycloak-services: DCR protocol mapper type-swap policy bypass allows privilege escalation
A flaw was found in Keycloak's Dynamic Client Registration DCR security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a client update if the mapper's configuration remains...
keycloak-services: keycloak: FGAP v2 parent group children endpoint bypasses per-child view permission filter
A flaw was found in the Fine-Grained Admin Permissions FGAP v2 implementation within Keycloak's administrative services. When FGAP v2 is enabled, the system fails to properly filter child groups based on the caller's specific permissions when requested through a parent group. This allows a...