CVE-2026-15133 vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-R2P6-2GJ6-77XG vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-9MQJ-G68Q-H5RW vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-WVR7-3CPQ-C6MG vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-15594 waooAI waoowaoo Media hash.ts stablePublicIdFromStorageKey improper authorization

A vulnerability was found in waooAI waoowaoo up to 0.4.1. Impacted is the function stablePublicIdFromStorageKey in the library src/lib/media/hash.ts of the component Media Handler. The manipulation of the argument storageKey results in improper authorization. The attack may be performed from...

CVE-2026-49970

creationtimestamp| type| source ---|---|--- 2026-07-13 18:52:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqkefsdmh627 2026-07-13 19:40:38+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqkh3wqres2s 2026-07-13 20:01:37+00:00| seen|...

CVE-2026-61462

creationtimestamp| type| source ---|---|--- 2026-07-13 18:48:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqke5w7ni22d 2026-07-13 19:02:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqkexp5qxn2t 2026-07-14 04:01:23+00:00| seen|...

CVE-2026-54064

creationtimestamp| type| source ---|---|--- 2026-07-13 18:35:05+00:00| published-proof-of-concept| https://github.com/nukeviet/nukeviet/security/advisories/GHSA-465g-4q99-5x86...

CVE-2026-59818

creationtimestamp| type| source ---|---|--- 2026-07-13 18:30:27+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkd6gqmpf2w 2026-07-16 08:05:40+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqrnye4md2p...

UBUNTU-CVE-2026-53365

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix zerocopy completion for multi-skb sends When a large message is fragmented into multiple skbs, the zerocopy uarg is only allocated and attached to the last skb in the loop. Non-final skbs carry pinned user pages...

RLSA-2026:38500 Important: maven:3.9 security update

Maven is a software project management and comprehension tool. Based on the concept of a project object model POM, Maven can manage a project's build, reporting and documentation from a central piece of information. Security Fixes: org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Travers...

CVE-2026-13221

creationtimestamp| type| source ---|---|--- 2026-07-13 17:43:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqkakeohr427 2026-07-13 18:30:14+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqkd626fd62t 2026-07-14 14:44:05+00:00| seen|...

CVE-2026-13239

creationtimestamp| type| source ---|---|--- 2026-07-13 17:36:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqka56ugml2b...

CVE-2026-13233

creationtimestamp| type| source ---|---|--- 2026-07-13 17:30:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqk7sj363e2h 2026-07-22 17:00:05+00:00| seen| Telegram/q3tIaYx4agFM3da1rV7jtAQTpWs9uwXUcQ2UZM8hUpw4XQ 2026-07-22 17:00:05+00:00| seen|...

GHSA-Q79H-67VX-M9XG Decidim: CSV census record endpoints improper authorization

Description A participant manager can access and modify the CSV census record admin forms. Technical description The CSV census admin record-management surface under /admin/csvcensus/censuslogs does not enforce admin-only authorization before rendering or mutating Decidim::Verifications::CsvDatum...

CVE-2026-61462 mcp-gitlab Path Traversal via job_id Parameter

mcp-gitlab contains a path traversal vulnerability in the jobid parameter of build/index.js that allows attackers to redirect GitLab API requests to arbitrary endpoints. Attackers can supply crafted jobid values like ../../../user to escape the intended path prefix and access arbitrary GitLab API...

GHSA-R3V7-5X4C-C69Q Decidim: JWT-backed authentication can be replayed across organizations

Description A JWT issued to an Org 1 account is accepted on the Org 2 API and can read the admin-only GraphQL participantDetails field for an Org 2 participant. The same trust-boundary problem also affects API-user authentication: an Org 1 API user can use a JWT on the Org 1 host and replay that...

CVE-2024-27091

creationtimestamp| type| source ---|---|--- 2026-07-13 17:11:49+00:00| seen| https://gist.github.com/alon710/1cf437e22a892172012205a9b0e24d57...

CVE-2026-57793

creationtimestamp| type| source ---|---|--- 2026-07-13 16:17:53+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqk3rehykv2d 2026-07-16 08:02:39+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqriltamp2g...

PYSEC-2026-3018 pypdf: Possible infinite loop when processing threads/articles in writer

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with threads/articles into a writer. Patches This has been fixed in pypdf==6.13.1. Workarounds If users cannot upgrade yet, consider applying the changes from PR 3839...