Vulnerabilities
Recent vulnerabilities
Recent vulnerabilities from
π GNA-1 (CIRCL)
Select from 80 available sources using the dropdown above.
Bitnami VulnDB is not individually searchable yet β the search will cover the sources available on the search page.
| ID | Description | Published | Updated |
|---|---|---|---|
| bit-python-2026-17084 | stringprep.map_table_b2() deviates from RFC 3454 Table B.2 | 2026-08-24T09:42:07.053Z | 2026-08-24T10:01:09.721Z |
| bit-python-2026-15806 | `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching | 2026-08-24T09:42:05.799Z | 2026-08-24T10:01:09.721Z |
| bit-libpython-2026-17084 | stringprep.map_table_b2() deviates from RFC 3454 Table B.2 | 2026-08-24T09:36:57.332Z | 2026-08-24T10:01:09.721Z |
| bit-libpython-2026-15806 | `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching | 2026-08-24T09:36:56.153Z | 2026-08-24T10:01:09.721Z |
| bit-cosign-2026-22703 | Cosign verification accepts any valid Rekor entry under certain conditions | 2026-08-24T09:32:29.312Z | 2026-08-24T10:01:09.721Z |
| bit-vault-2026-14886 | Vault Enterprise vulnerable to cross-namespace entity deletion | 2026-08-24T05:55:35.006Z | 2026-08-24T06:09:24.796Z |
| bit-valkey-2026-63639 | Valkey: UAF in stream deserialization may lead to remote code execution | 2026-08-24T05:53:59.815Z | 2026-08-24T06:09:24.796Z |
| bit-valkey-2026-56684 | Valkey: TLS pending-data processing use-after-free may allow remote code execution | 2026-08-24T05:53:58.352Z | 2026-08-24T06:09:24.796Z |
| bit-mastodon-2026-59825 | Mastodon: Unwanted deactivation of SSL/TLS certificate verification | 2026-08-24T05:45:37.108Z | 2026-08-24T06:09:24.796Z |
| bit-authentik-2026-61574 | authentik RAC: access any endpoint via an unrelated application | 2026-08-24T05:36:29.888Z | 2026-08-24T06:09:24.796Z |
| bit-authentik-2026-57580 | authentik: Account Takeover via SAML NameID Comment Truncation | 2026-08-24T05:36:28.652Z | 2026-08-24T06:09:24.796Z |
| bit-authentik-2026-55106 | authentik: Unauthenticated LDAP directory data disclosure | 2026-08-24T05:36:27.363Z | 2026-08-24T06:09:24.796Z |
| bit-authentik-2026-54730 | authentik: Authentication Flow Bypass via Unguarded challenge_valid() in AuthenticatorEndpointGDTCStage and GoogleChromeStageView | 2026-08-24T05:36:26.121Z | 2026-08-24T06:09:24.796Z |
| bit-discourse-2026-55704 | Discourse: Shared-draft titles and excerpts leak through group post serialization | 2026-08-21T11:26:41.076Z | 2026-08-21T11:49:56.463Z |
| bit-discourse-2026-55674 | Discourse: Cache poisoning/XSS via color scheme cookies | 2026-08-21T11:26:39.921Z | 2026-08-21T11:49:56.463Z |
| bit-discourse-2026-53960 | Discourse: Hidden first-post excerpt is emitted in Q&A schema JSON-LD | 2026-08-21T11:26:33.150Z | 2026-08-21T11:49:56.463Z |
| bit-gitlab-2026-19650 | Cross-Site Request Forgery (CSRF) in GitLab | 2026-08-21T09:07:36.177Z | 2026-08-21T09:11:01.118Z |
| bit-gitlab-2026-19478 | Improper Control of Generation of Code ('Code Injection') in GitLab | 2026-08-21T09:07:34.847Z | 2026-08-21T09:11:01.118Z |
| bit-wordpress-2026-65640 | 2026-08-21T08:58:07.788Z | 2026-08-21T09:11:01.118Z | |
| bit-mlflow-2026-69148 | MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id | 2026-08-21T08:50:13.561Z | 2026-08-21T09:11:01.118Z |
| bit-mlflow-2026-69146 | MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth | 2026-08-21T08:50:12.154Z | 2026-08-21T09:11:01.118Z |
| bit-discourse-2026-59829 | Discourse: Review queue exposes flag-related private message excerpts to category group moderators | 2026-08-21T08:45:14.834Z | 2026-08-21T09:11:01.118Z |
| bit-grafana-2026-11817 | CVE-2026-11817 CVE Record | 2026-08-21T08:43:32.031Z | 2026-08-21T09:11:01.118Z |
| bit-mlflow-2026-64849 | MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding) | 2026-08-21T05:51:48.507Z | 2026-08-21T06:12:36.893Z |
| bit-neo4j-2026-14587 | Unathenticated connection can hold Bolt channel open | 2026-08-21T05:51:22.529Z | 2026-08-21T06:12:36.893Z |
| bit-python-2026-3087 | shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs | 2026-08-19T11:42:48.087Z | 2026-08-19T12:00:51.730Z |
| bit-python-2026-15308 | Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations | 2026-08-19T11:42:45.470Z | 2026-08-19T12:00:51.730Z |
| bit-powershell-2026-50523 | Microsoft PowerShell Remote Code Execution Vulnerability | 2026-08-19T11:41:11.861Z | 2026-08-19T12:00:51.730Z |
| bit-golang-2026-56865 | Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog | 2026-08-19T11:37:53.415Z | 2026-08-19T12:00:51.730Z |
| bit-golang-2026-56864 | Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb | 2026-08-19T11:37:52.101Z | 2026-08-19T12:00:51.730Z |