EUVD-2026-95523

In Progress® Telerik® Report Server prior to version 12.2.26.1007, incorrect privilege assignment in the service-agent SignalR hub allows an authenticated user, including a low-privilege or guest account with a valid bearer token, to register as a trusted service agent. On the next server...

EUVD-2026-87887

The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 2.26.8.26 does not have any capability check in a routine that outputs its stored remote storage settings into admin pages when the site is left in a...

CVE-2026-67334 better-auth Stale Sessions Persist After User Deletion

better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up to seven days...

WordPress CYAN Backup plugin < 2.5.3 - Admin+ Stored XSS via Remote Storage Settings vulnerability

Admin+ Stored XSS via Remote Storage Settings vulnerability discovered by Bob Matyas in WordPress Plugin CYAN Backup versions 2.5.3...

JetBrains TeamCity < 2025.11.1 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2025.11.1. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2025.11.1 excessive privileges were possible due to storing GitHub personal access token instead of an installation token...

CVE-2025-68268

In JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings page...

CVE-2025-68268

In JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings page...

CVE-2025-68268

In JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings page...

CVE-2025-68268

In JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings page...

CVE-2025-68268

In JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings page...

EUVD-2025-203762

In JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings page...

CVE-2025-68268

CVE-2025-68268 is a reflected XSS vulnerability in JetBrains TeamCity versions before 2025.11.1, specifically on the storage settings page. The connected Nessus advisory corroborates that TeamCity

JetBrains TeamCity 跨站脚本漏洞

JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides features such as continuous unit testing, code quality analysis and build issue analysis reports. A cross-site scripting vulnerability exists in JetBrai...

CVE-2025-68268: Improper Neutralization of Input During Web Page Generation

In JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings page...

PT-2025-51719

In JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings page...

EUVD-2008-3071

Malware in sbrugna...

EUVD-2024-51694

Malicious code in bioql PyPI...

CVE-2025-9629

The USS Upyun plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.0. This is due to missing or incorrect nonce validation on the usssettingpage function when processing the ussset form type. This makes it possible for unauthenticated attacker...

CVE-2025-9629

The USS Upyun plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.0. This is due to missing or incorrect nonce validation on the usssettingpage function when processing the ussset form type. This makes it possible for unauthenticated attacker...

CVE-2025-9629 USS Upyun <= 1.5.0 - Cross-Site Request Forgery

The USS Upyun plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.0. This is due to missing or incorrect nonce validation on the usssettingpage function when processing the ussset form type. This makes it possible for unauthenticated attacker...