Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics

ChartsController::actionGetNewUsersData at /actions/charts/get-new-users-data is missing a requirePermission'viewUsers' authorization check. Any authenticated control panel user, regardless of permissions beyond accessCp, can POST to this endpoint to receive time-series user registration counts f...

CVE-2026-71488 league/commonmark: Quadratic-time denial of service when parsing crafted Markdown

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths repeatedly rescan growing portions of a line to translat...

EUVD-2026-54143

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths repeatedly rescan growing portions of a line to translat...

CVE-2026-71488 league/commonmark: Quadratic-time denial of service when parsing crafted Markdown

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths repeatedly rescan growing portions of a line to translat...

CVE-2026-71488

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths repeatedly rescan growing portions of a line to translat...

CVE-2026-71488

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths repeatedly rescan growing portions of a line to translat...

CVE-2026-71438

creationtimestamp| type| source ---|---|--- 2026-08-06 20:32:06+00:00| seen| https://gist.github.com/alon710/1523a448808a9bd39531599fad70a2e8...

MAL-2026-13461 Malicious code in supersig (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 557f8e62aa65bb4fe5e96a52cf6c5ba83c2f1bcf47eca3027bf4daca071249e5 The published dist bundles dist/supersig.cjs.js, dist/supersig.esm.js, dist/supersig.umd.js, reached via the package's main/module/browser entries on...

CVE-2026-13444

creationtimestamp| type| source ---|---|--- 2026-08-06 19:37:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3msgs3prfro24...

CVE-2026-15235

creationtimestamp| type| source ---|---|--- 2026-08-06 19:15:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msgqufchaa2n...

CVE-2026-18322

creationtimestamp| type| source ---|---|--- 2026-08-06 18:15:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msgnj44m7r2n 2026-09-24 21:11:58+00:00| seen| https://bsky.app/profile/packetstorm.bsky.social/post/3mwc6ah37yn2y...

CVE-2026-16619 miniOrange 2FA < 6.2.8 - 2FA Bypass via Unlimited Second-Factor Attempts

The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on every login, allowing an attacker who already knows a user's password to guess the one-time code...

CVE-2026-16619

The CVE-2026-16619 entry affects the miniOrange 2FA WordPress plugin, specifically versions before 6.2.8. The vulnerability arises because the plugin does not properly limit second-factor verification attempts; it tracks attempts using a client-supplied identifier that is reissued on every login,...

SUSE CVE-2026-71287

Cacti's sanitizesqlcolumn lib/functions.php sanitizes user-supplied ORDER BY column names using the regex . Because this allowlist retains letters, digits, underscore, parentheses, and dot intended to support expressions like COUNTid and table.column, a payload such as passes through completely...

Malicious code in pilgrimage-portal-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73b9f604c074795de9d79071f9e8a6c131e0a30159f6ea2a0769ded3df6d5a28 On npm install, the package's postinstall hook runs node ping.js, which reads the installer's hostname via require'os'.hostname and POSTs it, along...

CVE-2026-70637

creationtimestamp| type| source ---|---|--- 2026-08-06 16:14:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/dfebd4n6mb6sx...

CVE-2026-65576

creationtimestamp| type| source ---|---|--- 2026-08-06 16:00:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msgfxnnuia22...

CVE-2025-49506

APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or Android. Users are...

AZL-94628 CVE-2025-49506 affecting package apr-util for versions less than 1.6.3-3

APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or Android. Users are...

ALPINE-CVE-2025-49506

APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or Android. Users are...