34032 matches found
EUVD-2026-43026
The miniOrange Social Login and Register Discord, Google, Twitter, LinkedIn plugin for WordPress is vulnerable to authentication bypass leading to account takeover in versions up to and including 7.7.0. This is due to the Profile Completion flow accepting an arbitrary email address via the...
CVE-2026-53448
creationtimestamp| type| source ---|---|--- 2026-07-10 20:28:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqcye5a7lo27 2026-07-11 01:08:57+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdi2a3mob22...
CVE-2026-55370
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's existing TOTP verification accepted a successfully used TOTP code again while the code remained inside the RFC 6238 acceptance window because the verifier used otplib's stateless check with window ...
CVE-2026-11321
The DataInjection plugin for GLPI 2.15.6 GLPI 11 builds concatenates user-supplied CSV field values directly into SQL queries during CSV import, without parameterization or escaping, resulting in authenticated SQL injection. An authenticated user with access to the Data injection feature can embe...
CVE-2026-55370
Technical details about CVE-2026-55370 are not publicly available in the provided documents. Monitor for updates.
EUVD-2026-43011
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's existing TOTP verification accepted a successfully used TOTP code again while the code remained inside the RFC 6238 acceptance window because the verifier used otplib's stateless check with window ...
CVE-2026-55370 Logto: TOTP code can be replayed within the RFC 6238 validity window (one-time use violation)
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's existing TOTP verification accepted a successfully used TOTP code again while the code remained inside the RFC 6238 acceptance window because the verifier used otplib's stateless check with window ...
CVE-2026-55370 Logto: TOTP code can be replayed within the RFC 6238 validity window (one-time use violation)
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's existing TOTP verification accepted a successfully used TOTP code again while the code remained inside the RFC 6238 acceptance window because the verifier used otplib's stateless check with window ...
CVE-2026-15297
creationtimestamp| type| source ---|---|--- 2026-07-10 19:55:10+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcwj5btnq2f...
CVE-2026-15146
creationtimestamp| type| source ---|---|--- 2026-07-10 19:52:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqcwdstqlc27 2026-07-11 01:08:36+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdhzm6kuv2f 2026-08-11 20:01:12+00:00| seen|...
CVE-2026-11321
The DataInjection plugin for GLPI 2.15.6 GLPI 11 builds concatenates user-supplied CSV field values directly into SQL queries during CSV import, without parameterization or escaping, resulting in authenticated SQL injection. An authenticated user with access to the Data injection feature can embe...
CVE-2026-11321 GLPI DataInjection Plugin Authenticated SQL Injection via CSV Import
The DataInjection plugin for GLPI 2.15.6 GLPI 11 builds concatenates user-supplied CSV field values directly into SQL queries during CSV import, without parameterization or escaping, resulting in authenticated SQL injection. An authenticated user with access to the Data injection feature can embe...
EUVD-2026-42993
The DataInjection plugin for GLPI 2.15.6 GLPI 11 builds concatenates user-supplied CSV field values directly into SQL queries during CSV import, without parameterization or escaping, resulting in authenticated SQL injection. An authenticated user with access to the Data injection feature can embe...
CVE-2026-11321 GLPI DataInjection Plugin Authenticated SQL Injection via CSV Import
The DataInjection plugin for GLPI 2.15.6 GLPI 11 builds concatenates user-supplied CSV field values directly into SQL queries during CSV import, without parameterization or escaping, resulting in authenticated SQL injection. An authenticated user with access to the Data injection feature can embe...
CVE-2026-11321 GLPI DataInjection Plugin Authenticated SQL Injection via CSV Import
The DataInjection plugin for GLPI 2.15.6 GLPI 11 builds concatenates user-supplied CSV field values directly into SQL queries during CSV import, without parameterization or escaping, resulting in authenticated SQL injection. An authenticated user with access to the Data injection feature can embe...
CVE-2026-15291
creationtimestamp| type| source ---|---|--- 2026-07-10 18:40:33+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcsdod5q62s 2026-07-12 19:01:39+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqhugxoekp2m...
MCP Atlassian: DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826)
Summary GHSA-7r34-79r5-rcc9's fix added validateurlforssrf, which resolves the attacker-controlled X-Atlassian-Jira,Confluence-Url header host once at middleware time and trusts the result. But the outbound request is later built with the raw hostname and re-resolves at connect time with no IP...
GHSA-489G-7RXV-6C8Q MCP Atlassian: DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826)
Summary GHSA-7r34-79r5-rcc9's fix added validateurlforssrf, which resolves the attacker-controlled X-Atlassian-Jira,Confluence-Url header host once at middleware time and trusts the result. But the outbound request is later built with the raw hostname and re-resolves at connect time with no IP...
Malicious code in buffer-util-internal (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d329e426a3af00dc4cb53c8535a3e53848f09a1b80e561f84f29c77bffe746d7 Package impersonates Feross Aboukhadijeh's widely-used buffer package, copying its author, repository, contributors, and description metadata while...
CVE-2026-56765
creationtimestamp| type| source ---|---|--- 2026-07-10 16:44:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqcltiwe322h 2026-07-12 07:01:31+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqgm7kzfna2w...