Browse CVEs

CRITICAL 9.1 CVE-2026-15616 Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized … No fix yet Fix from $2,3002026-07-23 HIGH 7.5 CVE-2026-15615 Logto omits validation of the SAML <Conditions> element, enabling attackers to strip time and audience restrictions and replay assertions indefinitel… No fix yet Fix from $1,9502026-07-23 HIGH 7.5 CVE-2026-15614 Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window. No fix yet Fix from $1,9502026-07-23 CRITICAL 9.1 CVE-2026-15612 Logto bypasses OIDC nonce validation when the nonce claim is absent from the id_token, enabling replay of authentication tokens and weakening session… No fix yet Fix from $2,3002026-07-23 CRITICAL 9.1 CVE-2026-15611 Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s email and … No fix yet Fix from $2,3002026-07-23 MEDIUM 5.2 CVE-2026-11804 Improper handling of insufficient permissions or privileges vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterp… No fix yet Fix from $1,6002026-07-23 HIGH 7.7 CVE-2026-43820 NIOSSLCertificate._subjectAlternativeNames provides access to the raw bytes for a cert's SANs. NIOSSL provides access to a buffer assumed to be backe… No fix yet Fix from $1,9502026-07-23 HIGH 7.5 CVE-2026-43823 When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-freed: first in the catch block, then in the deini… No fix yet Fix from $1,9502026-07-23 MEDIUM 6.1 CVE-2026-65914 DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wra… Dompurify 3.3.2+ Fix from $1,6002026-07-23 MEDIUM 6.1 CVE-2026-65913 DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by pollu… Dompurify 3.3.2+ Fix from $1,6002026-07-23 MEDIUM 6.1 CVE-2026-65912 DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function via EXTRA_ELEMENT_HANDLING.at… Dompurify 3.3.2+ Fix from $1,6002026-07-23 MEDIUM 6.1 CVE-2026-65911 In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HA… Dompurify 3.4.0+ Fix from $1,6002026-07-23 MEDIUM 6.1 CVE-2026-65903 DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS res… Dompurify 3.4.0+ Fix from $1,6002026-07-23 MEDIUM 6.1 CVE-2026-65902 DOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets t… Dompurify 3.4.7+ Fix from $1,6002026-07-23 MEDIUM 6.1 CVE-2026-65901 DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form node… Dompurify 3.4.7+ Fix from $1,6002026-07-23 MEDIUM 6.1 CVE-2026-65900 DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT… Dompurify 3.4.8+ Fix from $1,6002026-07-23 MEDIUM 6.1 CVE-2026-65899 DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across tru… Dompurify 3.4.9+ Fix from $1,6002026-07-23 HIGH 7.2 CVE-2026-65898 DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to p… Dompurify 3.4.11+ Fix from $1,9502026-07-23 HIGH 8.8 CVE-2026-65690 Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its file upload functionality that all… Standalone Report Designer 14.1.12+ Fix from $1,9502026-07-23 CRITICAL 9.8 CVE-2026-65689 Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its database download feature that all… Standalone Report Designer 14.1.12+ Fix from $2,3002026-07-23 CRITICAL 9.8 CVE-2026-65688 Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its font processing feature that allow… Standalone Report Designer 14.1.12+ Fix from $2,3002026-07-23 CRITICAL 9.8 CVE-2026-65687 Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its SVG processing feature that allows… Standalone Report Designer 14.1.12+ Fix from $2,3002026-07-23 MEDIUM 5.3 CVE-2026-16735 A security vulnerability has been detected in release-it conventional-changelog up to 11.0.1. This affects the function writeChangelog of the file in… No fix yet Fix from $1,6002026-07-23 MEDIUM 5.3 CVE-2026-16733 A weakness has been identified in bahmutov find-cypress-specs up to 1.54.12. The impacted element is the function shell.exec of the file src/index.js… No fix yet Fix from $1,6002026-07-23 HIGH 7.5 CVE-2026-14257 brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max… Patch available Fix from $1,9502026-07-23 HIGH 8.6 CVE-2026-65908 In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on untrusted project open Pycharm 2026.1.4+ Fix from $1,9502026-07-23 CRITICAL 9.1 CVE-2026-65907 In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible No fix yet Fix from $2,3002026-07-23 CRITICAL 10.0 CVE-2026-65906 In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible Teamcity 2025.11.6 / 2026.1.2+ Fix from $2,3002026-07-23 HIGH 8.8 CVE-2026-65897 Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create(), allowing authenticated api.users.write c… Patch available Fix from $1,9502026-07-23 HIGH 7.1 CVE-2026-65896 Grav API Plugin (Composer package getgrav/grav-plugin-api) before 1.0.10 fails to properly validate the slug field in the POST /pages/{route}/move en… Patch available Fix from $1,9502026-07-23