CVE ID :CVE-2026-116208 Published : Oct. 25, 2026, 2:17 p.m. | 3 hours, 48 minutes ago Description :YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other actors’ mirrored entries. Attackers can serve…
CVE ID :CVE-2026-116211 Published : Oct. 25, 2026, 2:17 p.m. | 3 hours, 48 minutes ago Description :YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-creation request is concatenated unescaped into an…
CVE ID :CVE-2026-116204 Published : Oct. 25, 2026, 2:17 p.m. | 3 hours, 48 minutes ago Description :YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools) that lets unauthenticated attackers delete or restore pages through an administrator’s…
CVE ID :CVE-2026-114820 Published : Oct. 24, 2026, 7:17 p.m. | 43 minutes ago Description :Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected…
CVE ID :CVE-2026-115557 Published : Oct. 24, 2026, 3:17 p.m. | 4 hours, 42 minutes ago Description :Python has added a denylist for known compromised certificates to the “ssl” module to ensure user safety even without certificate revocation configured. Known compromised certificates…
CVE ID :CVE-2026-115933 Published : Oct. 24, 2026, 3:17 p.m. | 4 hours, 42 minutes ago Description :Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route…
CVE ID :CVE-2026-115932 Published : Oct. 24, 2026, 1:16 p.m. | 6 hours, 43 minutes ago Description :When a post is published, Postiz treats a media path that is not a web address as a file on the server’s disk, but it…
CVE ID :CVE-2026-116019 Published : Oct. 24, 2026, 12:16 p.m. | 7 hours, 43 minutes ago Description :Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-*@ directives with unset-name@…
CVE ID :CVE-2026-115935 Published : Oct. 23, 2026, 9:40 p.m. | 11 minutes ago Description :The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user. A non-admin user with only accessCp can place newline characters in X-Craft-Plugin-Licenses. Craft passes this value…
CVE ID :CVE-2026-58202 Published : Oct. 23, 2026, 9:17 p.m. | 35 minutes ago Description :OpenReception’s appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.0.0, the account-confirmation link in emails is built from the request Host…