medium5.3
CVE-2026-63115
ActivityPub Undo handler can unfollow or remove reposts on behalf of other accounts
TryGhost · ActivityPub
Your agent Now with CVE context
Find published vulnerabilities, affected versions, and available fixes.
Bring the source evidence into your coding agent to investigate what affects your project.
Sponsored by MoxsoBuild security habits with adaptive training and phishing simulations.Opens in a new tabORIGINAL EVIDENCE. READY FOR YOUR WORKFLOW.CVE / OSV / CISA KEV
Find vulnerabilities that affect you.
Explore advisories by severity, ecosystem, and known exploitation. Take the evidence into your next agent session.
Severity
23 matching advisories · 23 shown
Follow substantive record changes →SEVERITYVULNERABILITY / AFFECTED PACKAGESPUBLISHED
high7.1
high8.2
CVE-2026-119422
Hyperswitch before 1.128.0 Webhook Authentication Bypass via Worldpayxml Connector
juspay · hyperswitch
medium6.8
CVE-2026-93008
Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurations
Red Hat · Red Hat Ceph Storage 9 / Red Hat · Red Hat Enterprise Linux 10
unknown
CVE-2026-110985
Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured
Apache Software Foundation · Apache Kafka
unknown
CVE-2026-110952
Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default
Apache Software Foundation · Apache Kafka
high8.8
CVE-2026-103402
Session Smart Router and Session Smart Conductor: Lack of integrity verification in cache files causes arbitrary code execution and privilege escalation
Juniper Networks · Session Smart Router / Juniper Networks · Session Smart Conductor
medium5.3
CVE-2026-103330
Sadad QA Payment 1.28 - Unauthenticated Arbitrary Order Payment Confirmation via Signature Bypass
Unknown · Sadad QA Payment
medium5.3
CVE-2026-103313
BitPay Gateway for WooCommerce <= 4.1.3 - Unauthenticated Payment Bypass via Payment Return Handler
Unknown · BitPay Gateway for WooCommerce
high8.7
CVE-2026-118377
mews/pos through 2.0.0 Missing Hash Verification in 3D Pay and 3D Host Callbacks
mewebstudio · pos
medium6.0
CVE-2026-104381
Fireware OS Missing Authentication in FireCluster State Sync Allows BOVPN Tunnel Denial of Service
WatchGuard · Fireware OS / WatchGuard · Fireware OS
medium5.5
CVE-2026-115408
ML-KEM key-pair lookup can bind an unrelated or attacker-planted public key, exposing encapsulated shared secrets
Eclipse Foundation · Eclipse KeyPont
medium5.3
CVE-2026-103359
PayDunya WooCommerce Payment Gateway 1.1.6 - Unauthenticated Order Payment Completion via Webhook Forgery
Unknown · PayDunya WooCommerce Payment Gateway
medium6.4
CVE-2026-116608
DAMO Academy VideoLLaMA2 Model Loading __init__.py load_pretrained_model integrity check
DAMO Academy · VideoLLaMA2
medium6.8
high8.8
CVE-2026-56832
PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals
MervinPraison · PraisonAI
critical9.9
GHSA-7hp6-4w63-5g45Fix available
LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key
medium6.5
CVE-2026-91588
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search).
Oracle Corporation · Oracle Business Intelligence Enterprise Edition
high8.6
CVE-2026-55103
Discourse ActivityPub: Fix inbound actor validation and apply outbound request SSRF hardening
discourse · discourse-activity-pub
medium5.6
CVE-2026-102682
Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation
pipecat-ai · pipecat
high8.8
high7.0
CVE-2026-50526
.NET Tampering Vulnerability
Microsoft · .NET 10.0 runtime / Microsoft · .NET 8.0 runtime
high8.1
CVE-2026-47304
.NET Security Feature Bypass Vulnerability
Microsoft · .NET 10.0 runtime / Microsoft · .NET 8.0 runtime