48792 matches found
EUVD-2026-33444
iskorotkov/avro is a fast Go Avro codec. Prior to 2.33.0, the Avro array and map decoders looped over an attacker-controlled block-count value without checking the underlying reader's error state inside the loop body. Reader.ReadBlockHeader returns the count as a Go int, which is 64-bit on amd64 ...
CVE-2026-46385
Summary (CVE-2026-46385) iskorotkov/avro’s Go Avro decoder can trigger remote, unauthenticated CPU exhaustion by looping up to math.MaxInt64 iterations when decoding large attacker-controlled block counts, because inner loops did not check the reader’s error state after each decode. Affected: git...
CVE-2026-47740
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, Multiple Filament actions on the admin Order detail and Order shipments table were callable by an authenticated low-privilege user without the permission required to mutate orders. The order detail actions cancel, mark paid, mark...
CVE-2026-47125
creationtimestamp| type| source ---|---|--- 2026-05-29 19:00:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmz7v62jq52a 2026-05-29 20:16:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmze567paf2r...
CVE-2026-47740 Shopper: Authorization bypass in multiple Livewire admin components
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, Multiple Filament actions on the admin Order detail and Order shipments table were callable by an authenticated low-privilege user without the permission required to mutate orders. The order detail actions cancel, mark paid, mark...
EUVD-2026-33410
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, Multiple Filament actions on the admin Order detail and Order shipments table were callable by an authenticated low-privilege user without the permission required to mutate orders. The order detail actions cancel, mark paid, mark...
CVE-2026-47741 Shopper: Race condition on Discount.usage_limit allows silent over-redemption
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, CreateOrderFromCartAction::execute previously created the Order row before checking and incrementing the discount's totaluse counter. Under concurrent checkout pressure Black Friday, flash sale, viral coupon, the global usagelimit was...
vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass
Summary A sandbox escape vulnerability in vm2 allows arbitrary code execution in the host process when untrusted code is executed with async support on runtimes exposing WebAssembly JSPI WebAssembly.promising / WebAssembly.Suspending. In the tested configuration, a JSPI-backed Promise can reach...
CVE-2026-44648
SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, SillyTavern relies on cookie-session for authentication, storing all session data user handle,...
CVE-2018-25391
HaPe PKH 1.1 fails to enforce authorization on its record deletion endpoints, allowing unauthenticated attackers to delete arbitrary records by sending a crafted request that specifies the target record's id. The admin/modul/modpengurus/aksipengurus.php module=pengurus&act=hapus and...
RLSA-2026:19135 Important: opentelemetry-collector security update
Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry Security Fixes: net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to...
SUSE-SU-2026:2116-1 Security update for csync2
This update for csync2 fixes the following issue - CVE-2026-41051: uses insecure temporary directories when compiled with C99 or later bsc1262472...
WordPress Booking Manager plugin <= 2.1.18 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dodoh4t in WordPress Plugin Booking Manager versions = 2.1.18...
CVE-2026-44698
creationtimestamp| type| source ---|---|--- 2026-05-29 15:01:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmysjlmepp2v 2026-05-29 16:18:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmywtjjgs62e...
CVE-2026-45615
creationtimestamp| type| source ---|---|--- 2026-05-29 15:01:31+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmysjevepa2m 2026-05-29 16:13:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmywkkihvl2x...
CVE-2026-45707
creationtimestamp| type| source ---|---|--- 2026-05-29 15:00:28+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmyshiifaa2m 2026-05-29 16:23:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmyx4hyvj52m...
CVE-2026-44595
creationtimestamp| type| source ---|---|--- 2026-05-29 15:00:15+00:00| seen| Telegram/a86W4JR7O--z7UEFDSjPGooPu8cJg6Qw5misZZ2a8xOkaUM 2026-05-29 21:00:04+00:00| seen| Telegram/7EeES1995AuZh7L7sqmaK3TqJ83qHuwNNd4oo-aSS2rD4M...
CVE-2026-44596
creationtimestamp| type| source ---|---|--- 2026-05-29 15:00:15+00:00| seen| Telegram/a86W4JR7O--z7UEFDSjPGooPu8cJg6Qw5misZZ2a8xOkaUM 2026-05-29 21:00:04+00:00| seen| Telegram/7EeES1995AuZh7L7sqmaK3TqJ83qHuwNNd4oo-aSS2rD4M 2026-07-17 19:18:06+00:00| seen|...
CVE-2026-45610
WWBN AVideo is an open source video platform. In 29.0 and earlier, there is a cross-site request forgery vulnerability on the 2FA toggle. plugin/LoginControl/set.json.php accepts POST type=set2FA value=false, calls LoginControl::setUser2FAUser::getId, false on the session-authenticated user, and...
