2107161 matches found
MGASA-2026-0453 Updated udisks2 package fixes a security vulnerability
Local privilege escalation via as-user option spoofing. CVE-2026-7867...
MGASA-2026-0454 Updated gpsd packages fix a security vulnerability
Command Injection via gnuplot plot title subtype field. CVE-2026-58459...
ROOT-APP-GOBINARY-CVE-2026-56864 CVE-2026-56864 in golang.org/x/mod - Patched by Root
Root has patched CVE-2026-56864 in the golang.org/x/mod package for Root:Go. Multiple fixed versions available...
ROOT-APP-GOBINARY-CVE-2026-56865 CVE-2026-56865 in golang.org/x/mod - Patched by Root
Root has patched CVE-2026-56865 in the golang.org/x/mod package for Root:Go. Multiple fixed versions available...
GHSA-G7VJ-C29H-3H5M FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
Impact An unauthenticated account takeover vulnerability exists in fof/oauth when the Discord OAuth provider is enabled. Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with...
MINI-R47V-Q555-V6CW
Bulletin has no description...
MINI-GJ6C-Q4CR-94MH
Bulletin has no description...
MINI-PFHX-P3M9-GVG6
Bulletin has no description...
MINI-VMWX-CVRR-V6CV
Bulletin has no description...
MINI-6246-GX69-33W4
Bulletin has no description...
MINI-3PXM-XJ6F-4FRV
Bulletin has no description...
MINI-2J2Q-8X3W-WMFQ
Bulletin has no description...
MINI-P54F-P32V-QH9G
Bulletin has no description...
MINI-RCPV-G37W-QW79
Bulletin has no description...
MINI-CWGV-2XCF-224V
Bulletin has no description...
MINI-5VGP-RGJ7-43XF
Bulletin has no description...
MINI-8656-M94W-32WJ
Bulletin has no description...
MINI-PJ2Q-9MQC-H9C2
Bulletin has no description...
MINI-7M8J-R993-4P2P
Bulletin has no description...
MINI-FRJQ-WWM8-8332
Bulletin has no description...
MINI-RVWF-39MF-8C3R
Bulletin has no description...
MINI-54PC-H3QF-6V22
Bulletin has no description...
MINI-4M4V-6CCG-5VWJ
Bulletin has no description...
MINI-4GC9-J299-C784
Bulletin has no description...
MINI-6PJX-794F-CFMV
Bulletin has no description...
MINI-HVMX-9M2R-7G4W
Bulletin has no description...
MINI-J2HQ-42JF-933X
Bulletin has no description...
MINI-QJ43-4MV2-5XH4
Bulletin has no description...
MINI-XW49-6W7F-HF3W
Bulletin has no description...
MINI-VP5M-CMGQ-8XF7
Bulletin has no description...
MINI-XQC4-H9Q7-P8GX
Bulletin has no description...
MINI-44CF-6RXQ-C8RP
Bulletin has no description...
BIT-PARSE-2026-87806 Parse Server 9.0.0 Authentication Bypass via LDAP Empty Password
Parse Server versions = 9.0.0 9.10.1 contain an authentication bypass in the built-in LDAP authentication adapter. The adapter forwarded the client-supplied password to the directory without verifying that a password had been supplied, and treated any non-error response from the directory as proo...
BIT-PARSE-2026-66009 Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages
Parse Server versions = 9.0.0 before 9.10.0 and = 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled graphQLPublicIntrospection: false, the default. A client holding only the public application id — with n...
BIT-PARSE-2026-66008 Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages
Parse Server versions = 9.0.0 before 9.10.0 and = 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled graphQLPublicIntrospection: false, the default. Because these errors are...
BIT-PARSE-2026-64627 Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion
Parse Server versions = 9.0.0 before 9.10.0 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled graphQLPublicIntrospection: false, the default, schema-derived 'Did you mean ...?' suggestions were still returned i...
BIT-PARSE-2026-61448 Parse Server 9.0.0 Stored XSS via malformed Content-Type
Parse Server is affected by a stored cross-site scripting XSS vulnerability in versions = 9.0.0, 9.10.0 and = 8.6.83. When an uploaded file's extension is not recognized by the mime package, Parse Server preserves the client-supplied Content-Type. A malformed Content-Type that is not a valid...
MINI-J7FV-JQ3C-F7V9
Bulletin has no description...
ROOT-APP-GOBINARY-CVE-2026-84445 CVE-2026-84445 in google.golang.org/grpc - Patched by Root
Root has patched CVE-2026-84445 in the google.golang.org/grpc package for Root:Go. Multiple fixed versions available...
ROOT-APP-GOBINARY-CVE-2026-84304 CVE-2026-84304 in google.golang.org/grpc - Patched by Root
Root has patched CVE-2026-84304 in the google.golang.org/grpc package for Root:Go. Multiple fixed versions available...
MINI-JG28-QRW2-723P
Bulletin has no description...
BIT-POSTGIS-2026-73515 PostGIS < 3.7.0 Out-of-Bounds Read via FlatGeobuf Buffer
PostGIS before 3.7.0 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a string length field is present but fails to verify that the...
MINI-V8PC-7RFV-G6X5
Bulletin has no description...
MINI-33CJ-RPV8-JP3G
Bulletin has no description...
GHSA-V65J-HFF3-753C Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled
Summary With $wgEmbedVideoRequireConsent disabled not the default, the urls for videos are passed into an iframe src attribute without sanitization. When given a malformed url or id, the src attribute can be escaped via double quotes, allowing for html/javascript injection. Details The iframe...
GHSA-QXG3-46RW-79J8 code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute
Impact A Stored Cross-Site Scripting XSS vulnerability exists in the rich text editor due to improper sanitization of the srcdoc attribute on elements. While the underlying Symfony HtmlSanitizer correctly HTML-encodes special characters inside the attribute value e.g., converting to script, the...
ROOT-APP-GOBINARY-CVE-2026-56852 CVE-2026-56852 in golang.org/x/text - Patched by Root
Root has patched CVE-2026-56852 in the golang.org/x/text package for Root:Go. Multiple fixed versions available...
GHSA-VJ3Q-VP3G-J9C8 code16/sharp has a stored XSS via data-html-content Sanitizer Bypass
Impact The vulnerability allows an attacker to bypass the HTML sanitizer by using the data-html-content attribute in the content of a SharpEditorFormField. Patches The field must now explicitly configure SharpFormEditorField::RAWHTML in the toolbar to keep this behavior. When using the RAWHTML...