3600 matches found
CVE-2026-37171
CVE-2026-37171 affects SuperTokens Core, versions 6.0.0 to 11.4.0. The root cause is a lack of tenant separation, enabling an authenticated party in one tenant to access sessions, data, and endpoints of another tenant. The CVSS 3.1 base score is 5.9 (Medium) with vectors: AV:N/AC:H/PR:L/UI:N/S:U/...
kernel: ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()
A flaw was found in the Linux kernel's IPv6 In-situ Operations, Administration, and Maintenance IOAM functionality. A remote attacker can send a specially crafted packet that manipulates the nodelen field while processing trace data. This manipulation leads to a heap buffer overflow, causing...
net/url: Incorrect parsing of IPv6 host literals in net/url
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...
CVE-2026-66678
CVE-2026-66678 concerns a Broken Access Control issue in the WordPress plugin Advanced Custom Fields: Font Awesome Field , affecting versions up to and including 6.1.1 . The connected sources consistently describe the vulnerability class and affected plugin/version but do not provide technical de...
EUVD-2026-53969
Unauthenticated SQL Injection in WP OAuth Server = 6.2.0 versions...
CVE-2026-13153
The CVE-2026-13153 entry concerns the Gutenberg Essential Blocks WordPress plugin prior to 6.4.0. The issue is that a public REST route is not access-restricted and the response over-fetches a non-public WooCommerce per-product sales metric, allowing unauthenticated users to read the lifetime num...
CVE-2026-70596 Ghost: Cross-Site Scripting in Feature Image Captions
Ghost is a Node.js content management system. From 4.9.0 until 6.54.1, an input validation issue allowed any staff user to create a post with content in featureimagecaption that could be used to hijack another staff user's Ghost Admin session, resulting in privilege escalation. This issue is fixe...
NPM: Ghost: Server-Side Request Forgery Mitigation Issue
NPM: Ghost: Server-Side Request Forgery Mitigation Issue vulnerability discovered by ? in WordPress Npm ghost versions = 6.26.0, 6.54.1...
CVE-2026-15452
The CVE covers the Smash Balloon Social Photo Feed – Easy Social Feeds Plugin for WordPress. Affected software: WordPress plugin versions up to 6.11.3. Vulnerability: Reflected Cross-Site Scripting via REQUEST_URI Query String caused by insufficient input sanitization and output escaping. Impact:...
CVE-2026-70592 Ghost: Database Backup Path Traversal
Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem through the database backup filename, leading to integrity and availability issues. The database export endpoint failed to reject path...
EUVD-2026-39025
Ghost: Private IP filtering bypass to make server-side requests to internal services...
CVE-2026-15337
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.utils.translation.checkforlanguage is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory...
CLSA-2026-1785204338 TuxCare security update for undici (6 CVEs)
TuxCare rebuilt undici to address 6 CVEs. Fixed in 6.11.1-tuxcare.4...
CLSA-2026-1784164061 TuxCare security update for 2 packages (4 CVEs)
TuxCare rebuilt 2 packages to address 4 CVEs. Fixed in 6.10.2-tuxcare.1...
CLSA-2026-1783386132 TuxCare security update for guzzlehttp/guzzle (2 CVEs)
TuxCare rebuilt guzzlehttp/guzzle to address 2 CVEs. Fixed in 6.0.2-p1+tuxcare...
CLSA-2026-1781052732 TuxCare security update for ajv (2 CVEs)
TuxCare rebuilt ajv to address 2 CVEs. Fixed in 6.11.0-tuxcare.1...
CLSA-2026-1780620667 TuxCare security update for cross-spawn (1 CVE)
TuxCare rebuilt cross-spawn to address 1 CVE. Fixed in 6.0.5-tuxcare.1...
CLSA-2026-1779065200 TuxCare security update for guzzlehttp/guzzle (5 CVEs)
TuxCare rebuilt guzzlehttp/guzzle to address 5 CVEs. Fixed in 6.3.3-p1+tuxcare...