CVEs
Browse the synced catalog, newest first.
- CVE-2026-70555rConfig Core 8.2.3 < 8.2.13 Cleartext Credential Exposure via APIrConfig
- CVE-2026-123802SuperTokens Core SAML: identity taken from an assertion that never passed the audience check, allowing sign-in as any IdP usersupertokens-core
- CVE-2026-123801SuperTokens Core: SAML callback accepts a replayed RelayState + SAMLResponse, minting a fresh authorization code on each replaysupertokens-core
- CVE-2026-125041Gst-plugins-good: gst-plugins-good: qtdemux out-of-bounds heap read from invalid uncompressed video layoutRed Hat Enterprise Linux
- CVE-2026-125040Gst-plugins-base: gst-plugins-base: quadratic regex processing in srt/webvtt subtitle parser causes denial of serviceRed Hat Enterprise Linux
- CVE-2026-123800SuperTokens Core: App-scoped API key can overwrite the parent connection URI domain's credentials and take over sibling applicationssupertokens-core
- CVE-2026-120834WordPress WP2LEADS plugin <= 3.5.17 - Privilege Escalation vulnerabilityTobias WP2LEADS
- CVE-2026-121769WordPress WP w3all phpBB plugin <= 3.1.9 - SQL Injection vulnerabilityaxew3.com WP w3all phpBB
- CVE-2026-121573WordPress WP Activity Log plugin <= 5.6.7 - Cross Site Scripting (XSS) vulnerabilityMelapress WP Activity Log
- CVE-2026-123799SuperTokens Core: Dashboard session tokens are never checked for expiry: `isValidUserSession` ignores the stored `expiry`, so a…supertokens-core
- CVE-2026-123798SuperTokens Core: SAML XML Signature Wrapping authentication bypass — any IdP user can authenticate as any other usersupertokens-core
- CVE-2026-84503Ansible-core: ansible-core: ansible.builtin.git invokes git without a `--` separator, allowing argument injection via a `-`-leading…Red Hat Migration Toolkit for Applications · Red Hat Mi… +12
- CVE-2026-123797SuperTokens Core: Unknown tenant path bypasses API key and public-tenant enforcementsupertokens-core
- CVE-2026-125063Automation-controller: automation-controller: quadratic regex in schedule rrule validation allows an authenticated user to exhaust api web…Red Hat Ansible Automation Platform
- CVE-2026-60117receive_sharing_intent 1.4.1-1.9.0 Path Traversal via FileDirectoryKasemJaffer receive_sharing_intent
- CVE-2026-123796compose-lint: Incomplete fix for GHSA-jf3h-8jvx-vcrg: a run stopped at the finding limit quotes a secret from a CI-generated `.env`tmatens compose-lint · compose-lint +1
- CVE-2026-123373compose-lint: A committed symlink makes compose-lint quote a file from outside the project into its outputtmatens compose-lint · compose-lint +1
- CVE-2026-123270CVE-2026-123270Redpanda Data Connect
- CVE-2026-123372compose-lint: A pull request can make compose-lint quote a secret from a CI-generated `.env` into its findingstmatens compose-lint · compose-lint +1
- CVE-2026-123371compose-lint: A `.compose-lint.yml` symlinked outside the project is read, and a parse error quotes part of the targettmatens compose-lint · compose-lint +1
- CVE-2026-123370compose-lint: `fix --apply` can delete a line the user did not select, including a security settingtmatens compose-lint · compose-lint
- CVE-2026-123369compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Actiontmatens compose-lint · tmatens/compose-lint +1
- CVE-2026-119756Tasmota 16.0.0 Heap Out-of-Bounds Write via Device Groups UDParendst Tasmota
- CVE-2026-119755Tasmota 16.0.0 CSRF via Referer Header Validation Bypassarendst Tasmota
- CVE-2026-123368compose-lint: .env read through a symlink outside the project can expose the CI job's environmenttmatens compose-lint · compose-lint +1
- CVE-2026-123367ThorVG: Heap buffer overflow (OOB write) in bundled jpgd JPEG decoderthorvg
- CVE-2026-19706Openshift/installer: openshift installer: unconditional csr approval during agent-based installation (abi) bootstrapAssisted Installer for Red Hat OpenShift Container Platf… +1
- CVE-2026-123364OctoPrint: Stored XSS via saved connection parametersOctoPrint
- CVE-2026-104989Pre-authentication remote code execution in Chaos V-Ray SwarmChaos Software V-Ray Swarm
- CVE-2026-121576WordPress MCP Server for WordPress plugin <= 2.0.1 - Privilege Escalation vulnerabilityAtlasAiDev MCP Server for WordPress