CVE ID :CVE-2026-94201 Published : Oct. 5, 2026, 7:19 p.m. | 27 minutes ago Description :Ash stores :atom-typed attributes as strings and compares them as strings. When such an attribute is referenced in a filter, the comparison value is coerced through…
CVE ID :CVE-2026-97283 Published : Oct. 5, 2026, 7:17 p.m. | 29 minutes ago Description :Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Object Injection.This issue affects Advanced Post Manager: from n/a through 4.5.5.…
CVE ID :CVE-2026-105640 Published : Oct. 5, 2026, 7:17 p.m. | 29 minutes ago Description :Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployments where email…
CVE ID :CVE-2026-105641 Published : Oct. 5, 2026, 7:17 p.m. | 29 minutes ago Description :Plane is an open-source project management tool. Prior to 1.4.0, the deployments/aio/community/ and deployments/cli/community/ manifests provide fixed, publicly known SECRET_KEY and LIVE_SERVER_SECRET_KEY defaults that remain active…
CVE ID :CVE-2026-105642 Published : Oct. 5, 2026, 7:17 p.m. | 29 minutes ago Description :Ghost is a Node.js content management system. From 6.56.0 until 6.67.0, an image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any…
CVE ID :CVE-2026-105216 Published : Oct. 4, 2026, 6:16 p.m. | 1 hour, 23 minutes ago Description :go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network attackers to impersonate services because the shared TLS helper sets InsecureSkipVerify to true…
CVE ID :CVE-2026-105218 Published : Oct. 4, 2026, 6:16 p.m. | 1 hour, 23 minutes ago Description :gopay before 1.5.119 disables TLS certificate verification in defaultClient() in pkg, allowing man-in-the-middle attackers to impersonate payment provider APIs. Attackers can present any certificate to…
CVE ID :CVE-2026-105219 Published : Oct. 4, 2026, 6:16 p.m. | 1 hour, 23 minutes ago Description :Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser in lib due to overlapping regex alternatives. Attackers…
CVE ID :CVE-2026-105086 Published : Oct. 4, 2026, 4:16 p.m. | 3 hours, 23 minutes ago Description :WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders to inject HTML by submitting doubly-encoded entities in video titles.…
CVE ID :CVE-2026-105089 Published : Oct. 4, 2026, 4:16 p.m. | 3 hours, 23 minutes ago Description :WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1…