CVE-2026-44506

creationtimestamp| type| source ---|---|--- 2026-09-04 20:20:04+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117214622691306928 2026-09-04 20:20:04+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3muprz6fxze2v...

EUVD-2026-45906

SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path...

CVE-2026-53932 wnx/laravel-backup-restore: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') and Improper Neutralization of Special Elements used in a Command ('Command Injection')

laravel-backup-restore restores database backups made with spatie/laravel-backup. Prior to version 1.9.4, a crafted backup archive can trigger OS command injection during database restore. This issue has been patched in version 1.9.4...

CVE-2026-53761

Frappe CRM is an open-source customer relationship management tool. Prior to version 1.73.0, there is an authentication bypass vulnerability via logged invitation keys in crm/api. This issue has been patched in version 1.73.0...

EUVD-2026-71633

Frappe CRM is an open-source customer relationship management tool. Prior to version 1.73.0, there is an authentication bypass vulnerability via logged invitation keys in crm/api. This issue has been patched in version 1.73.0...

CVE-2026-85636 jofpin trape Login Endpoint stats.py missing authentication

A vulnerability was identified in jofpin trape 1.0.0. Affected by this vulnerability is an unknown functionality of the file core/stats.py of the component Login Endpoint. The manipulation leads to missing authentication. The attack may be initiated remotely. The exploit is publicly available and...

authelia v4.39.22

!OpenSSF Scorecardhttps://shieldcn.dev/badge/dynamic/json.svg?url=https://img.shields.io/ossf-scorecard/github.com/authelia/authelia.json&query=$.message&label=openssf%20scorecard&logo=data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmc...

EUVD-2026-71257

IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 005 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data...

CVE-2026-19727

CVE-2026-19727 is an XSS (targeting HTML attributes) vulnerability in the Yordam Information Technology Consulting Library Information and Document Automation Program , caused by improper neutralization of input during web page generation. The issue affects versions before v22.2 and is rated CVSS...

opencode v1.18.27

The open source AI coding agent. English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dansk | 日本語 | Polski | Русский | Bosanski | العربية | Norsk | Português Brasil | ไทย | Türkçe | Українська | বাংলা | Ελληνικά | Tiếng Việt Installation YOLO curl -fsSL...

CLSA-2026-1788527318 TuxCare security update for com.mchange:c3p0 (1 CVE)

TuxCare rebuilt com.mchange:c3p0 to address 1 CVE. Fixed in 0.9.5.4-tuxcare.3...

EUVD-2026-71082

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in TAC Information Services Internal and External Trade Inc. GOLDENHORN ONEIT allows Blind SQL Injection. This issue affects GOLDENHORN ONEIT: before Göbeklitepe...

EUVD-2026-71025

The Grav Form plugin getgrav/grav-plugin-form versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate based solely on which response field key is present in the submitted payload. On a site configured for reCAPTCHA v3, an anonymous attacker can place their v3 token under the v2 fie...

BIT-NIFI-2024-45477 Apache NiFi: Improper Neutralization of Input in Parameter Description

Apache NiFi 1.10.0 through 1.27.0 support a description field for Parameters in a Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter Context, can enter arbitrary JavaScript code, which the client browser will...

Optimistic Locking/version Validation Bypass

Spring Data REST is vulnerable to improper handling of the persisted @Version property during HTTP PUT requests against immutable target types. The vulnerability is due to Spring Data REST failing to preserve the persisted version value of an aggregate root when processing a PUT request, which...

RHSA-2026:63327 Red Hat Security Advisory: Satellite 6.16.13 Async Update

Bulletin has no description...

RHSA-2026:60018 Red Hat Security Advisory: OpenShift Container Platform 4.17.57 packages and security update

Bulletin has no description...

RHSA-2026:59830 Red Hat Security Advisory: OpenShift Container Platform 4.12.97 packages and security update

Bulletin has no description...

CVE-2026-27086 WordPress WoodMart theme < 8.3.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Xtemos WoodMart allows DOM-Based XSS. This issue affects WoodMart: from n/a before 8.3.8...

[SECURITY] [DLA 4771-1] chromium security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4771-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort September 04, 2026 https://wiki.debian.org/LTS -...