VK-Scraper

VK Scraper vk-scraper is a command-line application written in Python that scrapes and downloads VK user's / community's data. Use responsibly. To get a better understanding of how it works, head to the docs. Features Scrape photos Scrape videos both uploaded and external Scrape saved photos Scra...

vk-geosearch

vk-geosearch Search for photos by geo-tags on the social networkvk.com Dependencies requests Installation git clone https://github.com/yevgen2020/vk-geosearch.git pip3 install requests cd vk-geosearch chmod +x search.py Usage To search for photos in VK, you need a service access key or a token...

Linux Distros Unpatched Vulnerability : CVE-2026-57178

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without...

social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing

Impact The vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such a...

GHSA-3C93-F73F-QC9H social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing

Impact The vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such a...

CVE-2026-57178

A flaw was found in social-auth-core. The VK application backend accepts callback data without verifying its cryptographic signature when the authentication key parameter is omitted. A remote attacker can exploit this vulnerability by submitting crafted callback requests with forged identity...

DEBIAN-CVE-2026-57178

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned...

CVE-2026-57178

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned...

CVE-2026-57178 social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned...

EUVD-2026-86312

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned...

CVE-2026-57178 social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned...

CVE-2026-57178

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned...

CVE-2026-57178

The Python Social Auth library, specifically the vk-app backend , is vulnerable to an authentication bypass in versions prior to 5.0.0 . The root cause is that the backend accepts VK application callback data without verifying the signature when the auth_key parameter is missing. This allows an a...

CVE-2026-57178: Improper Authentication

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned...

CVE-2026-17586

The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'vkExUnitctaimgposition' Post Meta in all versions up to, and including, 9.118.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

EUVD-2026-82746

The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'vkExUnitctaimgposition' Post Meta in all versions up to, and including, 9.118.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-17586 VK All in One Expansion Unit <= 9.118.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'vkExUnit_cta_img_position' Post Meta

The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'vkExUnitctaimgposition' Post Meta in all versions up to, and including, 9.118.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-17586

The VK All in One Expansion Unit WordPress plugin (versions up to and including 9.118.0 ) is vulnerable to Stored Cross-Site Scripting via the vkExUnit_cta_img_position post meta field. The root cause is insufficient input sanitization and output escaping: the sanitize_text_field callback on save...

CVE-2026-17586 VK All in One Expansion Unit <= 9.118.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'vkExUnit_cta_img_position' Post Meta

The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'vkExUnitctaimgposition' Post Meta in all versions up to, and including, 9.118.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-17586: Improper Neutralization of Input During Web Page Generation

The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'vkExUnitctaimgposition' Post Meta in all versions up to, and including, 9.118.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...