CVE-2026-43663

creationtimestamp| type| source ---|---|--- 2026-06-29 23:41:25+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphnzlvy332q 2026-06-30 21:18:11+00:00| seen| https://bsky.app/profile/geeknik.bsky.social/post/3mpjwienisy2d 2026-07-01 02:51:13+00:00| seen|...

GHSA-Q2M9-6JP9-C6MC Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query

Summary The checkUserPassword GraphQL query in Dgraph is vulnerable to DQL Dgraph Query Language injection. User-supplied password values are interpolated directly into a DQL checkpwd query via fmt.Sprintf without any escaping or parameterization. An attacker can inject a password containing a...

CVE-2026-43743

creationtimestamp| type| source ---|---|--- 2026-06-29 22:19:14+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphjgmo4ok25 2026-07-01 02:50:35+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0818 2026-07-01 16:00:58+00:00| seen|...

CVE-2026-57997

Strapi users-permissions plugin fails to restrict JWT algorithms when plugin::users-permissions.jwt.algorithm is not explicitly configured, allowing acceptance of HS384 and HS512 tokens alongside HS256. Attackers possessing the jwtSecret can mint tokens with non-standard HMAC variants to bypass...

CVE-2026-53404

creationtimestamp| type| source ---|---|--- 2026-06-29 22:15:39+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mphjaa6jki2d 2026-06-29 23:23:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mphmzpmaux2o 2026-06-29 23:31:20+00:00| seen|...

CVE-2026-13757

creationtimestamp| type| source ---|---|--- 2026-06-29 21:58:44+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphibxmbru2b 2026-07-11 17:28:36+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqf6ryg7t42s 2026-07-13 07:00:02+00:00| seen|...

CVE-2026-12672

creationtimestamp| type| source ---|---|--- 2026-06-29 20:25:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mphd3qywhk22...

GHSA-9GGV-8W38-R7PM vulnerabilities

Vulnerabilities for packages: redisinsight...

CVE-2026-37637

An issue in Alexantr filemanager v.1.0 allows a remote attacker to execute arbitrary code via the filemanager.php component...

CVE-2026-43701

The issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. A malicious website may be able to process restricted web content outside the sandbox...

CVE-2026-43712

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected process crash...

CVE-2026-43663

A memory-handling flaw in WebKit can be triggered by processing maliciously crafted web content, potentially leading to an unexpected process crash . This vulnerability affects Safari 26.5.2 , iOS 26.5.2 , iPadOS 26.5.2 , macOS Tahoe 26.5.2 , tvOS 26.6 , visionOS 26.6 , and watchOS 26.6 . The iss...

CVE-2026-43713

A permissions issue was addressed with additional restrictions. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Visiting a website may leak sensitive data...

CVE-2026-43676

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected Safa...

CVE-2026-56017 JavaScript::Minifier::XS versions before 0.16 for Perl crash with a NULL pointer dereference when the first meaningful token of the input is a slash

JavaScript::Minifier::XS versions before 0.16 for Perl crash with a NULL pointer dereference when the first meaningful token of the input is a slash. The regexp versus division disambiguator in JsTokenizeString XS.xs inspects the previous token's last byte to choose between a regexp literal and a...

CVE-2026-53427

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in leandrocp MDEx allows stored or reflected cross-site scripting via attacker-controlled Markdown. When syntax highlighting and full info-string forwarding render: fullinfostring: true are enabled, t...

CVE-2026-40061

creationtimestamp| type| source ---|---|--- 2026-06-29 18:17:30+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mph3wfdcyj2d...

CVE-2026-13751

creationtimestamp| type| source ---|---|--- 2026-06-29 17:54:54+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mph2nxm6hf2t 2026-06-29 18:43:47+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mph5feg6v52o 2026-06-29 20:15:46+00:00| seen|...

CVE-2026-13582

creationtimestamp| type| source ---|---|--- 2026-06-29 17:32:45+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgzgdp5gw2o 2026-06-29 20:32:40+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphdi2rf6h23 2026-06-29 22:14:12+00:00| seen|...

EUVD-2026-40157

Teable before 2026-06-15T04-43-24Z.1912 contains an improper access control vulnerability that allows anonymous attackers to access hidden field data by supplying arbitrary field IDs in the projection parameter of the share view records endpoint. Attackers can enumerate hidden field IDs from shar...