Kentico Xperience 13 CMS - Staging Service Authentication Bypass (WT-2025-0006)

An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through...

Apple Security Advisory 07-27-2026-3

Apple Security Advisory 07-27-2026-3 - macOS Sequoia 15.7.8 addresses buffer overflow, bypass, code execution, denial of service, double free, heap corruption, information leakage, integer overflow, out of bounds read, out of bounds write, traversal, and use-after-free vulnerabilities...

CVE-2026-66712

CVE-2026-66712 affects the WordPress plugin Simple Membership versions

CVE-2026-66712

Unauthenticated Broken Access Control in Simple Membership = 4.7.8 versions...

CVE-2026-17784 vulnerabilities

Vulnerabilities for packages: chromium...

Linux Distros Unpatched Vulnerability : CVE-2026-53504

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expression performs exponential backtracking on...

CLSA-2026-1782435546 TuxCare security update for handlebars (8 CVEs)

TuxCare rebuilt handlebars to address 8 CVEs. Fixed in 4.7.8-tuxcare.1...

GHSA-7QF5-7PPR-87V8 Duplicate Advisory: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8rxv-jg7p-wvg3. This link is maintained to preserve external references. Original Description Traefik versions = v3.7.0 and = v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX...

Duplicate Advisory: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8rxv-jg7p-wvg3. This link is maintained to preserve external references. Original Description Traefik versions = v3.7.0 and = v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX...

CVE-2026-53505

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:proportion filter does not enforce an upper bound on and runs in the post-transform phase. An attacker can trigger extremely large resizes CPU/memory exhaustion and cause denial of service. This issu...

CVE-2026-53505 Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:proportion filter does not enforce an upper bound on and runs in the post-transform phase. An attacker can trigger extremely large resizes CPU/memory exhaustion and cause denial of service. This issu...

CVE-2026-53505

Thumbor (open-source photo thumbnail service by globo.com) is affected prior to version 7.8.0. The filters:proportion() function does not enforce an upper bound on and executes during the post-transform phase, enabling extremely large resizes that can exhaust CPU/memory and cause a denial of ser...

CVE-2026-53504 Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expression performs exponential backtracking on crafted repeated numeric input, allowing a URL request to exhaust processing time. This issue is fixed in 7.8.0...

CVE-2026-53501 Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace when removing the signature from the URL before validation. Since .replace removes all occurrences of the substring, an attacker can insert...

PT-2026-66836

Name of the Vulnerable Software and Affected Versions Thumbor versions prior to 7.8.0 Description The ALLOWED SOURCES configuration, designed to restrict the hosts from which the HTTP loader fetches images, fails to escape dots when processing plain-string entries. These strings are passed direct...

PT-2026-66841

Name of the Vulnerable Software and Affected Versions Thumbor versions prior to 7.8.0 Description The convolution filter regular expression performs exponential backtracking when processing crafted repeated numeric input. This leads to a Regular Expression Denial of Service ReDoS, where a special...

CLEANSTART-2026-KC30939 Security fixes in argo-workflows-fips 3.7.8-r2

Package argo-workflows-fips version 3.7.8-r2 fixes 7 vulnerabilities: ghsa-fw7p-63qq-7hpr, ghsa-q9hv-hpm4-hj6x, ghsa-9h8m-3fm2-qjrq, CVE-2026-26958, CVE-2026-1229...

EUVD-2026-49455

An information disclosure issue was addressed with improved privacy controls. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. An app may be able to access sensitive user data...

EUVD-2026-49445

A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. A maliciously crafted ZIP archive may bypass Gatekeeper checks...

CVE-2026-64700

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system...