CVE ID :CVE-2026-105640 Published : Oct. 5, 2026, 7:17 p.m. | 29 minutes ago Description :Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployments where email…
CVE ID :CVE-2026-105641 Published : Oct. 5, 2026, 7:17 p.m. | 29 minutes ago Description :Plane is an open-source project management tool. Prior to 1.4.0, the deployments/aio/community/ and deployments/cli/community/ manifests provide fixed, publicly known SECRET_KEY and LIVE_SERVER_SECRET_KEY defaults that remain active…
CVE ID :CVE-2026-105642 Published : Oct. 5, 2026, 7:17 p.m. | 29 minutes ago Description :Ghost is a Node.js content management system. From 6.56.0 until 6.67.0, an image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any…
CVE ID :CVE-2026-105216 Published : Oct. 4, 2026, 6:16 p.m. | 1 hour, 23 minutes ago Description :go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network attackers to impersonate services because the shared TLS helper sets InsecureSkipVerify to true…
CVE ID :CVE-2026-105218 Published : Oct. 4, 2026, 6:16 p.m. | 1 hour, 23 minutes ago Description :gopay before 1.5.119 disables TLS certificate verification in defaultClient() in pkg, allowing man-in-the-middle attackers to impersonate payment provider APIs. Attackers can present any certificate to…
CVE ID :CVE-2026-105219 Published : Oct. 4, 2026, 6:16 p.m. | 1 hour, 23 minutes ago Description :Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser in lib due to overlapping regex alternatives. Attackers…
CVE ID :CVE-2026-105086 Published : Oct. 4, 2026, 4:16 p.m. | 3 hours, 23 minutes ago Description :WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders to inject HTML by submitting doubly-encoded entities in video titles.…
CVE ID :CVE-2026-105089 Published : Oct. 4, 2026, 4:16 p.m. | 3 hours, 23 minutes ago Description :WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1…
CVE ID :CVE-2026-96451 Published : Oct. 3, 2026, 4:16 p.m. | 3 hours, 16 minutes ago Description :Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1. Severity: 8.8…
CVE ID :CVE-2026-103065 Published : Oct. 3, 2026, 3:16 p.m. | 4 hours, 16 minutes ago Description :Improper Validation of Specified Quantity in Input vulnerability in Themeum Kirki kirki allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Kirki: from n/a…