262288 matches found
CVE-2026-10698
Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer Custom Reports modules. This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.8, from 2025.1.0 before 2025.1.4, from 2026.0.0 before 2026.0.1...
CVE-2026-59869 js-yaml: YAML merge-key chains can force quadratic CPU consumption
js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in...
CVE-2026-14967
BBOT's githubworkflows module could be induced to write a downloaded artifact outside its configured output directory: its path-containment check did not resolve .., so a crafted CODEREPOSITORY URL could traverse out of the intended folder. The write is bounded to two directory levels above the...
CVE-2026-49146 App::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounded context value in a project .ackrc
App::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounded context value in a project .ackrc. ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The -B and -C context options accepted any positive integer, and ack...
CVE-2026-49145
App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc. ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The project-source option blocklist in App::Ack::ConfigLoader does not include...
CVE-2026-56086
creationtimestamp| type| source ---|---|--- 2026-07-08 14:44:01+00:00| seen| https://bsky.app/profile/suriq.io/post/3mq5e6qdzn72d 2026-07-09 10:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq7f6or2nd2m...
CVE-2026-10699
Missing release of memory after effective lifetime vulnerability in Progress MOVEit Transfer Custom Reports modules. This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.8, from 2025.1.0 before 2025.1.4, from 2026.0.0 before 2026.0.1...
CVE-2026-15034
A vulnerability has been found in flask-dashboard Flask-MonitoringDashboard up to 5.0.2. Affected by this issue is some unknown functionality. Such manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used...
CVE-2026-54061
creationtimestamp| type| source ---|---|--- 2026-07-08 14:14:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq5cjezgt22z 2026-08-20 17:50:42+00:00| seen| https://bsky.app/profile/thestandup.bsky.social/post/3mtjsocbdbj2y 2026-08-20 18:35:03+00:00| published-proof-of-concept|...
CVE-2026-60092 AVideo - Stored Cross-Site Scripting via Unescaped User-Agent in Participants Panel
AVideo Meet plugin through commit e8d6119f3cb1b849149906efeb0a41fc024f59f8 contains a stored cross-site scripting vulnerability in the Meet plugin's getMeetInfo.json.php endpoint. When a participant joins a public meeting, the raw HTTP User-Agent header is stored meetjoinlog.useragent without...
CVE-2026-56775
n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization vulnerability in three mutating evaluation test-run endpoints that authorize state-changing actions using the workflow:read scope instead of the action-appropriate workflow:execute scope. On instances using Advanced Permissions...
EUVD-2026-42246
Capgo before 12.128.2 contains a policy bypass vulnerability in appversions update enforcement that allows app-scoped API keys to downgrade encrypted bundles to non-encrypted state. Attackers with app-scoped all API keys can directly update the appversions table via PostgREST to clear sessionkey...
CVE-2026-56217
Capgo before 12.128.2 contains a policy bypass vulnerability in appversions update enforcement that allows app-scoped API keys to downgrade encrypted bundles to non-encrypted state. Attackers with app-scoped all API keys can directly update the appversions table via PostgREST to clear sessionkey...
CVE-2019-10660
creationtimestamp| type| source ---|---|--- 2026-07-08 13:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq5ahbcwux2s...
CVE-2026-58480
creationtimestamp| type| source ---|---|--- 2026-07-08 13:30:32+00:00| seen| https://infosec.exchange/users/offseq/statuses/116884598388668562 2026-07-08 13:30:34+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mq5a3kmqpd2j 2026-07-08 14:12:06+00:00| seen|...
WordPress Cart Lift plugin <= 3.1.57 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dodoh4t in WordPress Plugin Cart Lift versions = 3.1.57...
ROOT-APP-PYPI-CVE-2024-21520 CVE-2024-21520 in rootio-djangorestframework - Patched by Root
Root has patched CVE-2024-21520 in the rootio-djangorestframework package for Root:PyPI. Multiple fixed versions available...
buildah security update
An update is available for buildah. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The buildah package provides a tool for facilitating building OCI container...
Important: Red Hat Security Advisory: nginx:1.26 security, bug fix, and enhancement update
An update for the nginx:1.26 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...