264167 matches found
CVE-2026-40793 WordPress Groundhogg plugin < 4.4.1 - Broken Access Control vulnerability
Subscriber Broken Access Control in Groundhogg 4.4.1 versions...
CVE-2026-53703
creationtimestamp| type| source ---|---|--- 2026-06-15 20:18:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moe45dozpw2j...
CVE-2026-34900 WordPress GiveWP plugin <= 4.14.2 - Reflected Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in GiveWP = 4.14.2 versions...
CVE-2026-54295
creationtimestamp| type| source ---|---|--- 2026-06-15 20:03:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moe3cpxdpf2b 2026-07-31 18:35:23+00:00| published-proof-of-concept| https://github.com/nltk/nltk/security/advisories/GHSA-fg7f-2386-8897...
CVE-2026-47261 Wasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction
Wasmtime is a runtime for WebAssembly. In versions prior to 24.0.9, 36.0.10, and 44.0.2, when a filesystem preopen is given DirPerms::all and FilePerms::READ without FilePerms::WRITE, this access control mechanism can be bypassed via the wasip2 descriptor.open-at or wasip1 pathopen interfaces by...
CVE-2026-47825 Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies in certain situations
Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios. This affects both the WebMVC and WebFlux Gateway Servers. Affected versions: Spring Cloud Gateway 3.1.x fix 3.1.13. Spring Cloud Gateway 4.1.x fix 4.1.13. Spri...
PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys
!NOTE Scored assuming a deployment where algorithm policy functions as an authentication/authorization boundary. In deployments where the algorithm policy enforces crypto agility only, the practical confidentiality impact is lower and the issue is closer to an integrity-of-policy-enforcement bug...
CVE-2026-9260
creationtimestamp| type| source ---|---|--- 2026-06-15 19:00:00+00:00| seen| https://jvn.jp/en/vu/JVNVU98100934 2026-06-16 04:20:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moex3aitgp22...
DEBIAN-CVE-2026-8356
LibreOffice can import presentations in the legacy binary PPT format. A stack buffer overflow existed when importing a colour-replacement record. Two fixed-size colour tables were filled from the file, but the write position was not reset between the two passes over the record, so a file whose...
CVE-2026-47777
Mastodon is a free, open-source social network server based on ActivityPub. In versions there is a missing condition in the check if remote accounts consented to be featured in a remote Collection could lead to attackers bypassing the check and faking consent. An attacker could forge the...
Exploit for CVE-2025-2783
Chromium CVE-2025-2783: Sandbox Escape & Full-Chain RCE Exploi...
Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection
Summary Nodemailer constructs List- headers from the caller-provided list message option using internally prepared header values. The list..comment field is inserted into those prepared values without removing CR \r or LF \n characters. Because prepared headers bypass the normal header-value...
@amwaljs/checkout-angular (0.2.11), @bitblit/ngx-acute-common (>=6.1.182-alpha, <=6.1.201-alpha) +53 more potentially affected by CVE-2026-54266 via @angular/common (>=21.0.0, <=21.2.16)
@angular/common NPM version =21.0.0, =6.1.182-alpha, =6.1.182-alpha, =0.1.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =3.0.1, =2.0.1, =2.0.1, =2.0.1, =6.0.1, =2.0.1, =4.0.0, =6.1.0-edge.5 and more Source cves: CVE-2026-54266 Source advisory: SNYK:JS-ANGULARCOMMON-17356555...
CVE-2026-6045 Heap buffer overflow in EMF+ gradient brush import
LibreOffice can import EMF+ graphics, which may be embedded in documents. A heap buffer overflow existed when importing an EMF+ gradient brush. The number of gradient blend points was read from the file and used to compute an allocation size, but that multiplication could overflow, so a small...
CVE-2026-20262 Cisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerability
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system. This vulnerability exists because the affected software does not properly validate...
CVE-2026-49775
creationtimestamp| type| source ---|---|--- 2026-06-15 16:16:15+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3modomnbtv62o 2026-06-15 16:16:33+00:00| seen| https://bsky.app/profile/potato.software/post/3modon74ty22f...
CVE-2026-9595
Impact: When a user-configured proxy on webpack-dev-server has a broad context e.g. / and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend, bypasses the dev server's Host/Origin...
CVE-2026-5242
creationtimestamp| type| source ---|---|--- 2026-06-15 16:10:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3modoceu4652d 2026-06-15 18:02:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3modulbmoiu2n...
MGASA-2026-0208 Updated libinput packages fix security vulnerability
In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary root code execution...
