CVE-2026-48071 OpenReception's client PIN challenge throttle is keyed by emailHash only, allowing cross-tenant lockout

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the PIN-type challenge throttle uses emailHash as the only key. The throttle rows live in the central challengethrottle table, which is shared across all tenants...

CVE-2026-48071

OpenReception's appointment booking software (prior to version 1.0.4) has a vulnerability in the PIN-type challenge throttle. The throttle uses emailHash as the single key, with throttle rows stored in a shared central challenge_throttle table across tenants. As a result, failing challenges in on...

EUVD-2026-52668

External control of file name or path vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-image-writer allows Removing Important Client Functionality. This issue affects pardus-image-writer: before 1.0.4...

CVE-2026-18642

Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4...

CVE-2026-18642 Remote Code Execution via Insecure Deserialization in TÜBİTAK BİLGEM's eta-otp-lock

Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4...

CVE-2026-54722

DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, isurlsafe in src/helpers.ts strips the @ userinfo delimiter with removeatsymbolinstring before new URL parses the URL, allowing an attacker-controlled URL to bypass internal-IP...

CVE-2026-54722 dssrf: there a critical security bug with remove_at_symbol_in_string

DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, isurlsafe in src/helpers.ts strips the @ userinfo delimiter with removeatsymbolinstring before new URL parses the URL, allowing an attacker-controlled URL to bypass internal-IP...

CVE-2026-54722

DSSRF (Node.js library) has a vulnerability in is_url_safe prior to version 1.0.4. The bug arises because is_url_safe strips the @ userinfo delimiter via remove_at_symbol_in_string before parsing URLs, allowing an attacker-controlled URL to bypass internal-IP validation and cause a client using t...

CVE-2026-57427

CVE-2026-57427 documents an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting the WordPress Download Monitor — WPForms Lock plugin, version

EUVD-2026-48169

Unauthenticated Cross Site Scripting XSS in Download Monitor - WPForms Lock = 1.0.4 versions...

WordPress Download Monitor - WPForms Lock plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability

WordPress Download Monitor - WPForms Lock plugin = 1.0.4 - Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Download Monitor - WPForms Lock versions = 1.0.4...

CVE-2026-14459

Improper neutralization of argument delimiters in a command 'argument injection' vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-software allows Argument Injection. This issue affects pardus-software: from = 1.0.4 before 1.0.5...

CVE-2026-14460 Missing Authorization in TUBITAK BILGEM's pardus-software

Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-software allows Argument Injection. This issue affects pardus-software: from = 1.0.4 before 1.0.5...

EUVD-2026-41552

Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-software allows Argument Injection. This issue affects pardus-software: from = 1.0.4 before 1.0.5...

CVE-2026-14460

CVE-2026-14460 concerns pardus-software from TUBITAK BILGEM Software Technologies Research Institute. The vulnerability is described as a Missing Authorization flaw that allows Argument Injection in pardus-software versions up to and including 1.0.4, with 1.0.5 or later as the fixed release. Affe...

CVE-2026-14460

Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-software allows Argument Injection. This issue affects pardus-software: from = 1.0.4 before 1.0.5...

EUVD-2026-41550

Improper neutralization of argument delimiters in a command 'argument injection' vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-software allows Argument Injection. This issue affects pardus-software: from = 1.0.4 before 1.0.5...

CVE-2026-14459 Argument Injection in TUBITAK BILGEM's pardus-software

Improper neutralization of argument delimiters in a command 'argument injection' vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-software allows Argument Injection. This issue affects pardus-software: from = 1.0.4 before 1.0.5...

PT-2026-55542

Name of the Vulnerable Software and Affected Versions pardus-software versions prior to 1.0.5 Description Improper neutralization of argument delimiters in a command allows for argument injection. This occurs when the software fails to properly sanitize input used as command-line arguments,...

GHSA-82FG-2R99-H7V6 Duplicate Advisory: PickleScan's pkgutil.resolve_name has a universal blocklist bypass

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vvpj-8cmc-gx39. This link is maintained to preserve external references. Original Description picklescan before 1.0.4 fails to block pkgutil.resolvename, allowing attackers to bypass the entire blocklist by...