26732 matches found
CVE-2026-86112: Authorization Bypass Through User-Controlled Key
BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-only and direct statuses they cannot access. Attackers can POST to the favorite endpoint with a status ID to create...
CVE-2026-53602
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.7, two related authorization gaps let a host that should no longer be trusted obtain a fresh, valid Nebula certificate, because nebula-mgmt does not re-evaluate revocation/authorization state at certificate...
CVE-2026-80898
creationtimestamp| type| source ---|---|--- 2026-09-04 20:05:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117214564314860727...
CVE-2026-80848
creationtimestamp| type| source ---|---|--- 2026-09-04 19:51:25+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117214510129353453 2026-10-01 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20261002...
EUVD-2026-71715
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.7, two related authorization gaps let a host that should no longer be trusted obtain a fresh, valid Nebula certificate, because nebula-mgmt does not re-evaluate revocation/authorization state at certificate...
CVE-2026-85663
creationtimestamp| type| source ---|---|--- 2026-09-04 16:08:03+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mupdwlh55522 2026-09-04 16:10:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mupe274p6g22...
CVE-2026-80816 ALSA: FCP: Use a private URB for the notification endpoint
In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: Use a private URB for the notification endpoint fcpinitnotify used mixer-urb, which sndusbmixerstatuscreate allocates for the optional UAC2 status interrupt endpoint and mixer.c kills, resubmits and frees. On a device...
EUVD-2026-71251
In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: Use a private URB for the notification endpoint fcpinitnotify used mixer-urb, which sndusbmixerstatuscreate allocates for the optional UAC2 status interrupt endpoint and mixer.c kills, resubmits and frees. On a device...
CVE-2026-82728 Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoS
Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory on the client host and cause a denial of service. Two HTTP/1 response-parser states accumulate server data without any cap. In lib/mint/http1.ex, decodestatusline/4...
CVE-2026-78328
creationtimestamp| type| source ---|---|--- 2026-09-04 12:40:12+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3muoycvzfvn26 2026-09-04 20:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mupsl3nf4r2l 2026-09-04 22:00:51+00:00| seen|...
GHSA-Q2VG-7QGX-X5FC
creationtimestamp| type| source ---|---|--- 2026-09-04 11:32:02+00:00| seen| https://gist.github.com/alon710/5faf93883253b8cbdcfb378cbb150745...
CVE-2026-75431
creationtimestamp| type| source ---|---|--- 2026-09-04 09:45:00+00:00| seen| https://gist.github.com/unpredictable21/39e6ce22e4bc45b0e553d0fa6a6e4d1c 2026-09-04 18:08:37+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mupko5ze6u2w 2026-09-05 07:02:26+00:00| seen|...
GHSA-X67C-8PWR-M8G3
creationtimestamp| type| source ---|---|--- 2026-09-04 07:31:42+00:00| seen| https://gist.github.com/alon710/428fa3e523bd4efb06d0f15759388e47...
CVE-2026-84146
The Xpro Addons — 140+ Widgets for Elementor WordPress plugin, versions before 1.7.8 , contains a vulnerability where it fails to perform required capability or post-status checks. This allows unauthenticated visitors to retrieve sensitive details—including title, price, SKU, description, and sto...
EUVD-2026-70913
The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce product summary from a supplied product identifier, allowing unauthenticated visitors to retrieve the title, price, SKU, description and...
CVE-2026-84146 Xpro Elementor Addons < 1.7.8 - Unauthenticated Draft/Private Product Disclosure via Quick View
The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce product summary from a supplied product identifier, allowing unauthenticated visitors to retrieve the title, price, SKU, description and...
CVE-2026-17517 Content Views < 4.5.1.2 - Unauthenticated Non-Public Post Content Disclosure via Views Status Filter
The Content Views WordPress plugin before 4.5.1.2 does not check whether the user requesting a view is allowed to read the posts it returns, allowing unauthenticated attackers to obtain the title and content of non-public posts, such as draft, pending, private and scheduled posts, when a view has...
CVE-2026-17517
The Content Views WordPress plugin (versions before 4.5.1.2 ) is vulnerable to an unauthenticated non-public post content disclosure. The root cause is a failure to verify if a requesting user is authorized to read the posts returned by a specific view. This allows unauthenticated attackers to ob...
CVE-2026-17517 Content Views < 4.5.1.2 - Unauthenticated Non-Public Post Content Disclosure via Views Status Filter
The Content Views WordPress plugin before 4.5.1.2 does not check whether the user requesting a view is allowed to read the posts it returns, allowing unauthenticated attackers to obtain the title and content of non-public posts, such as draft, pending, private and scheduled posts, when a view has...