475853 matches found
CVE-2026-71434 Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types
Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.3 and 6.24.2, public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow...
CVE-2026-70558
Dinky CVE-2026-70558 affects the v1.2.5 release and development branch. The vulnerable component is the POST /download/uploadFromRsByLocal handler, which passes a caller-supplied path directly to new File(path) and file.transferTo(dest) with no path validation. The route is SaIgnore’d and /downlo...
CVE-2026-64662
Summary of CVE-2026-64662 (Statamic) : Statamic, a Laravel and Git powered CMS, had an issue where an authenticated Control Panel user could view content from entries they were not permitted to view, including entry content and custom field values, across any collection and including unpublished ...
CVE-2026-64665 Statamic: Account takeover via OAuth email matching without email-verification check
Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, when OAuth login was enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user, potentially including a super admin, witho...
CVE-2026-71433
CVE-2026-71433 affects LangGraph checkpoint stores for Postgres and SQLite. Before 3.1.1, langgraph-checkpoint-postgres and langgraph-checkpoint-sqlite persisted hierarchical namespaces as a dot-joined string and used a simple prefix match for reads, allowing an authenticated caller to access ite...
CVE-2026-48071 OpenReception's client PIN challenge throttle is keyed by emailHash only, allowing cross-tenant lockout
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the PIN-type challenge throttle uses emailHash as the only key. The throttle rows live in the central challengethrottle table, which is shared across all tenants...
CVE-2026-48071
OpenReception's appointment booking software (prior to version 1.0.4) has a vulnerability in the PIN-type challenge throttle. The throttle uses emailHash as the single key, with throttle rows stored in a shared central challenge_throttle table across tenants. As a result, failing challenges in on...
CVE-2026-64655 GitHub CLI: Attestation Verification Bypass via Unescaped Regex Metacharacters in SAN Matching
GitHub CLI gh is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is...
CVE-2026-65400
CVE-2026-65400 is a pre-authentication/network-remote issue in macOS Screen Sharing. Affected: macOS Sequoia 15.7.9, Sonoma 14.8.9, Tahoe 26.6.1. Description: an authentication issue was fixed via improved state management, preventing unauthorized network authentication to Screen Sharing. Impact ...
CVE-2026-64653
CVE-2026-64653 affects GitHub CLI (gh) prior to version 2.97.0, where certain HTTP request URLs interpolated unescaped variable path components, enabling path traversal to targeted API endpoints or resources. The underlying issue is in how path components were incorporated into requests without p...
CVE-2026-64677 Anki's local HTTP server is vulnerable to directory traversal attacks
Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read loca...
CVE-2026-64677
Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read loca...
CVE-2026-64677 Anki's local HTTP server is vulnerable to directory traversal attacks
Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read loca...
[SECURITY] Fedora 44 Update: libXfont2-2.0.9-1.fc44
X.Org X11 libXfont2 runtime library...
CVE-2026-14936 Simple Membership < 4.7.7 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification
The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the site's own configured merchant account before activating a membership, allowing unauthenticated users to activate or extend a membership using a payment made to an arbitrary PayP...
CVE-2026-15152
The vulnerability affects WP Hotel Booking plugin for WordPress prior to 2.3.2. It allows unauthenticated users to mark bookings as fully paid without actual payment: the plugin fails to verify that a PayPal payment notification corresponds to a payment to the site’s merchant account and that the...
CVE-2026-13399
The CVE refers to the WordPress PayPal WooCommerce Payment Plugins prior to version 2.0.20, which contains an authorization check flaw on a REST endpoint that allows unauthenticated users to bypass payments. Affected component: Payment Plugins for PayPal WooCommerce (WordPress plugin). Root cause...
CVE-2026-13399 Payment Plugins for PayPal WooCommerce < 2.0.20 - Unauthenticated Payment Bypass via Reuse of a Completed PayPal Order
The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.20 does not have proper authorization checks on a REST endpoint, allowing unauthenticated users to bypass payments...
CVE-2026-12584 Payment Gateway for Redsys & WooCommerce Lite < 7.0.2 - Unauthenticated Payment Confirmation via Unverified Inespay Callback
The Payment Gateway for Redsys & WooCommerce Lite WordPress plugin before 7.0.2 does not verify the authenticity of incoming payment-provider notifications for one of its payment methods before marking orders as paid, allowing unauthenticated attackers to forge a payment-confirmation callback and...
