•15 minutes ago•CVE-2026-57179
4.2CVE-2026-57179: Session Fixation and Login CSRF in social-auth-core Partial Pipeline
CVE-2026-57179 is a critical Session Fixation and Login Cross-Site Request Forgery (CSRF) vulnerability in python-social-auth's core library (social-auth-core) prior to version 5.0.0. The vulnerability allows remote attackers to force arbitrary state transitions and bind third-party social credentials to a victim's session, leading to complete account takeover.
0 views•7 min read
•about 1 hour ago•CVE-2026-57232
3.1CVE-2026-57232: Server-Side Request Forgery in Contao CMS Feed Reader Module
A Server-Side Request Forgery (SSRF) vulnerability exists in the Contao Open Source Content Management System (CMS) within the Feed Reader front-end module. When processing RSS feed configurations, the module initiates outbound HTTP connections using a default HTTP client that lacks loopback and private network controls. Authenticated backend users with permissions to configure frontend modules can exploit this flaw to coerce the server into sending requests to internal endpoints, loopback addresses, and cloud instance metadata services.
6 views•7 min read
•about 2 hours ago•CVE-2026-63498
8.7CVE-2026-63498: Stored Cross-Site Scripting via Inline XML Rendering in Snipe-IT API
CVE-2026-63498 is a high-severity Stored Cross-Site Scripting (XSS) vulnerability in Snipe-IT prior to version 8.7.0. The flaw resides in the REST API's file retrieval endpoint, which allows files to be rendered inline without sanitizing or restricting malicious content types like XML and XSLT stylesheets, leading to browser-side script execution in the context of the application's origin.
4 views•6 min read
•about 3 hours ago•CVE-2026-19730
4.2CVE-2026-19730: Podman Quadlet Install Non-Truncating Write Retains Removed Host-Access/Security Directives
CVE-2026-19730 is a local security vulnerability in the Podman container engine's Quadlet systemd generator. When updating existing configurations using 'podman quadlet install --replace' on filesystems that do not support reflink operations (such as standard ext4), the file is opened without the O_TRUNC flag. If the new configuration file is shorter than the pre-existing file, the trailing lines of the old file remain intact and are successfully parsed by systemd, leading to a failure to remove security-critical parameters like AddCapability, User, or host storage mounts.
5 views•7 min read
•about 4 hours ago•CVE-2026-63493
8.6CVE-2026-63493: Multi-Factor Authentication Bypass via Stateless API Token Flow in Snipe-IT
Snipe-IT prior to version 8.7.0 is vulnerable to an authentication bypass (CVE-2026-63493 / GHSA-hxcx-9h4f-42xx) within its Laravel Passport API integration. When multi-factor authentication (MFA/2FA) is enabled, an attacker possessing a victim's password can bypass MFA controls completely. This occurs because the Laravel middleware that enforces MFA was registered only in the stateful 'web' middleware group, leaving the stateless 'api' middleware group unguarded. Consequently, an attacker can use a valid password to initiate a session, bypass the MFA prompt on the web UI by communicating directly with the API, and generate a long-lived Personal Access Token (PAT) to perform unauthorized operations.
5 views•6 min read
•about 20 hours ago•CVE-2026-57576
6.5CVE-2026-57576: Application-Level Denial of Service via Uncontrolled Resource Consumption in Plone
CVE-2026-57576 is an application-level Denial of Service (DoS) vulnerability in Plone. It resides in the `plone.app.dexterity` and `plone.app.contenttypes` packages, allowing authenticated users with content creation permissions to submit excessively long metadata attributes. Because these fields are stored without length limits and subsequently processed by indexing and rendering engines, they trigger complete server resource exhaustion and thread starvation.
8 views•9 min read
•about 21 hours ago•GHSA-8PCW-H6W9-H46G
6.5GHSA-8PCW-H6W9-H46G: Denial of Service via Uncontrolled Resource Consumption in plone.app.contenttypes
An uncontrolled resource consumption vulnerability in plone.app.contenttypes allows authenticated users to trigger application-level denial of service via oversized filename metadata in file uploads.
7 views•6 min read
•about 22 hours ago•CVE-2026-61685
7.5CVE-2026-61685: SQL Injection via Dynamic Query Parameters in ReactPress
An unauthenticated remote SQL injection vulnerability exists in multiple API list endpoints of ReactPress prior to version 3.7.0. The vulnerability stems from unsafe construction of TypeORM QueryBuilder conditions, where untrusted HTTP query parameter keys are interpolated directly into SQL statements as identifiers without sanitization or validation.
9 views•9 min read
•about 23 hours ago•CVE-2026-56669
7.5CVE-2026-56669: Remote Denial of Service via Algorithmic Complexity and Interpretation Conflict in Elysia
CVE-2026-56669 is a high-severity vulnerability in the Elysia web framework (ElysiaJS) that combines Inefficient Algorithmic Complexity (CWE-407) and an Interpretation Conflict (CWE-436). It allows remote, unauthenticated attackers to cause a complete Denial of Service (DoS) via CPU resource exhaustion using specially crafted multipart or urlencoded payloads.
9 views•6 min read
•1 day ago•CVE-2026-86065
7.5CVE-2026-86065: Denial of Service via Resource Exhaustion in klever-go WebSocket Subscription Endpoint
Prior to version 1.7.20, the default-open WebSocket `/subscribe` endpoint in klever-go was vulnerable to remote resource exhaustion. Unauthenticated, remote attackers could crash validator and node processes by exploiting unbounded frame reads, uncapped concurrent connections, unrestricted memory allocation for subscription address keys, and a permanent memory leak in subscription map tracking on client disconnects.
9 views•7 min read
•1 day ago•CVE-2026-82405
8.7CVE-2026-82405: Incorrect Authorization leading to Account Takeover in klever-go
A critical incorrect authorization vulnerability (CWE-863) exists in the Go implementation of the Klever blockchain protocol (klever-go) prior to version 1.7.20. The vulnerability allows an attacker to completely replace a target account's permission set by manipulating the RecipientAddr parameter in a VM built-in function, leading to total account takeover.
9 views•5 min read
•1 day ago•CVE-2026-63000
6.4CVE-2026-63000: Cross-Site Request Forgery in REDAXO CMS Package Update API
A Cross-Site Request Forgery (CSRF) vulnerability in REDAXO CMS prior to version 5.21.2 allows unauthenticated remote attackers to trigger unauthorized package updates by exploiting an insecure default configuration in the base API class.
10 views•6 min read