2111800 matches found
CVE-2026-55610 InvoiceShelf has cross-company user read/update IDOR that enables cross-tenant account takeover
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.1, in InvoiceShelf's multi-company installations, any user who is an Owner of one company can read and overwrite any user account in any other...
CLSA-2026-1790174106 TuxCare security update for craftcms/cms (1 CVE)
TuxCare rebuilt craftcms/cms to address 1 CVE. Fixed in 3.9.15-p10+tuxcare...
CVE-2026-92164 Streamlink: HTTPSession follows HTTP redirects into file:// URLs, reading local files
Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.6.0, HTTPSession mounts a FileAdapter for the file scheme and inherits redirect handling from requests.Session without rejecting cross-protocol redirects. A remote server controlling an HTT...
CLSA-2026-1790173926 TuxCare security update for org.springframework (22 CVEs)
TuxCare rebuilt 23 org.springframework packages to address 22 CVEs. Fixed in 5.2.25.RELEASE-tuxcare.1...
GHSA-GXRG-X694-283W Solspace Freeform: Limited Twig template injection via submitted field values
Summary A limited server-side Twig template injection issue was identified in Solspace Freeform for Craft CMS. In affected versions, submitted form field values could be evaluated as Twig in certain rendering contexts. Unauthenticated users could submit Twig expressions through public Freeform...
CVE-2026-73858 Solspace Freeform: Limited Twig template injection via submitted field values
Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can be evaluated by the isolated Twig renderer when rendered into HTML attributes. An unauthenticated attacker can place Twig expressions in...
CLSA-2026-1790173339 TuxCare security update for symfony/http-foundation (1 CVE)
TuxCare rebuilt symfony/http-foundation to address 1 CVE. Fixed in 2.8.52-p2+tuxcare...
CVE-2026-96611
FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In movreadispe, uint32t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INTMAX to become negative. In readimagegrid, accumulating these value...
DEBIAN-CVE-2026-96512
A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an...
AZL-104940 CVE-2026-96512 affecting package sudo 1.9.17-3
A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an...
MAL-2026-16478 Malicious code in event-hunter (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f94b74862f327effaa43c1d01c4fd769626f73214d0706b80fef8b8a395cc3e8 On npm install, the declared postinstall hook runs node index.js, which reads os.hostname and a timestamp, base64-encodes the JSON payload, and issue...
GHSA-5MMC-8PC9-WGGG WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost
Summary WPGraphQL 2.19.0 contains an authorization bypass in the updatePost mutation. An authenticated WordPress Contributor can change one of their own draft posts to PUBLISH despite lacking the publishposts capability. The same mutation also permits the Contributor to modify their own previousl...
MAL-2026-16479 Malicious code in simplenewnpmpackage (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76315a0ce965c3a1f5b6342caa9d9ce8db4b341b641b2dbb696ebd52bd6149ec On require/import, index.js issues an HTTPS GET to a hardcoded interactsh OAST subdomain dapnhid534ch06s9vpm0mbg1httu5gytc.oast.fun with the...
CVE-2026-88974 WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost
WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-level editposts capability and the post author, but does not enforce the object-level editpost capability or require publishposts for publ...
MAL-2026-16477 Malicious code in com.apple.unityplugin.storekit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 920277566757bdc38563c7e2150e906790478cbd7a0c48f0bb53004e82eec4ca The package impersonates an Apple/Unity StoreKit internal namespace com.apple.unityplugin.storekit and, on require, index.js performs an HTTPS GET to...
GHSA-M8R3-22V6-G877 REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates
Summary The rexapiinstallpackageupdate API function install addon does not override requiresCsrfProtection, which defaults to false in the base class rexapifunction. Any authenticated admin can therefore be tricked via a CSRF attack into silently triggering a package update from the REDAXO packag...
CVE-2026-63000 REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates
REDAXO is a PHP-based content management system. Prior to 5.21.2, rexapiinstallpackageupdate in redaxo/src/addons/install/lib/api/apipackageupdate.php inherits the false default from rexapifunction::requiresCsrfProtection instead of requiring a CSRF token. An unauthenticated attacker can cause a...
CVE-2026-96609
Robur Albatross 1.0.0 through 2.x before 2.7.2 does not limit use of the ring buffer, leading to an albatross-console loop with no recognized termination condition. This is only exploitable by users who can send console subscription commands to unikernels that produce sufficient log output to fil...
CVE-2026-62998 REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration
REDAXO is a PHP-based content management system. Prior to 5.21.2, rexlist::getSortColumn in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable registered the requested column. An authenticated backend user can make prepareQuery add an escape...
GHSA-W998-QMW9-MF4M REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames
Summary The mediapool sync page sync.php renders filenames from the /media filesystem directory directly into HTML without applying rexescape i.e., htmlspecialchars. Any file placed in the media directory whose filename contains HTML metacharacters will execute JavaScript in the browser of any...
CVE-2026-63002 REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames
REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rexescape. An attacker who can place an unregistered file with HTML metacharacters in th...
GHSA-MF2P-WJP4-99PQ REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`
Summary A stored cross-site scripting XSS vulnerability exists in REDAXO CMS 5.x. When an administrator attempts to delete a media file that is referenced by a Media Manager effect, the warning message rendered in the backend includes the type's name field without HTML escaping. An attacker with...
CGA-G4WX-CM95-QGVC
Bulletin has no description...
CGA-39Q8-6GR3-C46G
Bulletin has no description...
CGA-8RJM-WWP4-67WM
Bulletin has no description...
CGA-MF4V-MFQ8-WH5X
Bulletin has no description...
CGA-4X7Q-564F-25W9
Bulletin has no description...
CGA-QF6V-VHX3-7J94
Bulletin has no description...
CGA-8V5J-QG4F-J5C6
Bulletin has no description...
CGA-Q7PC-2MG8-PMH6
Bulletin has no description...
CGA-RM9P-QGCF-3359
Bulletin has no description...
CGA-WX82-RQW3-7X9Q
Bulletin has no description...
CGA-JHV3-22WF-8MV3
Bulletin has no description...
CGA-XHHJ-96GJ-QV52
Bulletin has no description...
CGA-F26W-P4VP-HMV4
Bulletin has no description...
CGA-MFW9-7QXR-XCC5
Bulletin has no description...
CGA-QPGF-4C29-7G8W
Bulletin has no description...
CGA-3GRX-JV3X-9WP5
Bulletin has no description...
CGA-XP94-FRHM-HG7R
Bulletin has no description...
CGA-XV6F-FV95-G6H5
Bulletin has no description...
CGA-CXF8-J3QR-R72G
Bulletin has no description...
CGA-RM52-8WFQ-3R82
Bulletin has no description...
CGA-XHP6-837Q-32RR
Bulletin has no description...
CGA-VM8W-4R5W-837F
Bulletin has no description...
CGA-2VXP-7R6M-X2PW
Bulletin has no description...
CGA-36G7-CV4C-R4V8
Bulletin has no description...
CGA-76WQ-5Q74-J485
Bulletin has no description...
CGA-GXRX-PQHR-RW23
Bulletin has no description...