CVE-2026-67334 better-auth Stale Sessions Persist After User Deletion

better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up to seven days...

WordPress CYAN Backup plugin < 2.5.3 - Admin+ Stored XSS via Remote Storage Settings vulnerability

Admin+ Stored XSS via Remote Storage Settings vulnerability discovered by Bob Matyas in WordPress Plugin CYAN Backup versions 2.5.3...

JetBrains TeamCity < 2025.11.1 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2025.11.1. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2025.11.1 excessive privileges were possible due to storing GitHub personal access token instead of an installation token...

CVE-2025-68268

In JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings page...

CVE-2025-68268

In JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings page...

CVE-2025-68268

In JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings page...

CVE-2025-68268

CVE-2025-68268 is a reflected XSS vulnerability in JetBrains TeamCity versions before 2025.11.1, specifically on the storage settings page. The connected Nessus advisory corroborates that TeamCity

EUVD-2025-203762

In JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings page...

CVE-2025-68268

In JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings page...

CVE-2025-68268

In JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings page...

JetBrains TeamCity 跨站脚本漏洞

JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides features such as continuous unit testing, code quality analysis and build issue analysis reports. A cross-site scripting vulnerability exists in JetBrai...

PT-2025-51719

In JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings page...

CVE-2025-68268: Improper Neutralization of Input During Web Page Generation

In JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings page...

EUVD-2008-3071

Malware in sbrugna...

EUVD-2024-51694

Malicious code in bioql PyPI...

CVE-2025-9629

The USS Upyun plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.0. This is due to missing or incorrect nonce validation on the usssettingpage function when processing the ussset form type. This makes it possible for unauthenticated attacker...

CVE-2025-9629

The USS Upyun plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.0. This is due to missing or incorrect nonce validation on the usssettingpage function when processing the ussset form type. This makes it possible for unauthenticated attacker...

CVE-2025-9629 USS Upyun <= 1.5.0 - Cross-Site Request Forgery

The USS Upyun plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.0. This is due to missing or incorrect nonce validation on the usssettingpage function when processing the ussset form type. This makes it possible for unauthenticated attacker...

The vulnerability of the cloud-based messaging and streaming transmission platform Apache Pulsar lies in its authentication procedures’ deficiencies, which allow attackers to alter arbitrary storage settings, TTL values, and download configurations.

The vulnerability of the cloud-based messaging and streaming transmission platform Apache Pulsar is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to alter arbitrary storage settings, TTL values, and download configurations...

Input validation

Multiple unspecified "input validation" vulnerabilities in the Web management interface aka Messaging Administration interface in Avaya Message Storage Server MSS 3.x and 4.0, and possibly Communication Manager 3.1.x, allow remote authenticated administrators to execute arbitrary commands as user...