https://db.gcve.eu/sightings/feed 2026-07-22T23:09:23.273438+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent sightings. https://db.gcve.eu/sighting/0ce79c5d-6f12-4701-8caa-270413c38a49/export 2026-07-22T23:09:23.286777+00:00 cedric https://db.gcve.eu/user/cedric {"uuid": "0ce79c5d-6f12-4701-8caa-270413c38a49", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-26226", "type": "seen", "source": "https://t.me/cibsecurity/17398", "content": "\u203c CVE-2020-26226 \u203c\n\nIn the npm package semantic-release before version 17.2.3, secrets that would normally be masked by `semantic-release` can be accidentally disclosed if they contain characters that become encoded when included in a URL. Secrets that do not contain characters that become encoded when included in a URL are already masked properly. The issue is fixed in version 17.2.3.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-09T06:25:20.000000Z"} 2020-12-09T06:25:20+00:00 https://db.gcve.eu/sighting/ee7846b6-942c-44eb-9b17-1e5d0d63cb9c/export 2026-07-22T23:09:23.288108+00:00 cedric https://db.gcve.eu/user/cedric {"uuid": "ee7846b6-942c-44eb-9b17-1e5d0d63cb9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-26228", "type": "seen", "source": "https://t.me/cibsecurity/16755", "content": "\u203c CVE-2020-26228 \u203c\n\nTYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.23 and 10.4.10 user session identifiers were stored in cleartext - without processing with additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance SQL injection in any other component of the system. Update to TYPO3 versions 9.5.23 or 10.4.10 that fix the problem described.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-11-24T00:46:15.000000Z"} 2020-11-24T00:46:15+00:00 https://db.gcve.eu/sighting/6a6415c4-d88f-4a62-99e3-7cb9b1b9a971/export 2026-07-22T23:09:23.288220+00:00 cedric https://db.gcve.eu/user/cedric {"uuid": "6a6415c4-d88f-4a62-99e3-7cb9b1b9a971", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-26227", "type": "seen", "source": "https://t.me/cibsecurity/16748", "content": "\u203c CVE-2020-26227 \u203c\n\nTYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.23 and 10.4.10 the system extension Fluid (typo3/cms-fluid) of the TYPO3 core is vulnerable to cross-site scripting passing user-controlled data as argument to Fluid view helpers. Update to TYPO3 versions 9.5.23 or 10.4.10 that fix the problem described.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-11-24T00:46:05.000000Z"} 2020-11-24T00:46:05+00:00 https://db.gcve.eu/sighting/9fb13e3f-7c41-4fbc-9374-fa4d34b0a064/export 2026-07-22T23:09:23.288279+00:00 cedric https://db.gcve.eu/user/cedric {"uuid": "9fb13e3f-7c41-4fbc-9374-fa4d34b0a064", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-26226", "type": "seen", "source": "https://t.me/cibsecurity/16564", "content": "\u203c CVE-2020-26226 \u203c\n\nIn the npm package semantic-release before version 17.2.3, secrets that would normally be masked by `semantic-release` can be accidentally disclosed if they contain characters that become encoded when included in a URL. Secrets that do not contain characters that become encoded when included in a URL are already masked properly. The issue is fixed in version 17.2.3.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-11-19T00:40:41.000000Z"} 2020-11-19T00:40:41+00:00 https://db.gcve.eu/sighting/4ae7764d-fbc4-4c76-81e3-62929b274ba2/export 2026-07-22T23:09:23.288334+00:00 cedric https://db.gcve.eu/user/cedric {"uuid": "4ae7764d-fbc4-4c76-81e3-62929b274ba2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-26225", "type": "seen", "source": "https://t.me/cibsecurity/16413", "content": "\u203c CVE-2020-26225 \u203c\n\nIn PrestaShop Product Comments before version 4.2.0, an attacker could inject malicious web code into the users' web browsers by creating a malicious link. The problem was introduced in version 4.0.0 and is fixed in 4.2.0\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-11-17T00:44:08.000000Z"} 2020-11-17T00:44:08+00:00 https://db.gcve.eu/sighting/3975a068-db7c-4a3f-8464-137391a97f15/export 2026-07-22T23:09:23.288389+00:00 cedric https://db.gcve.eu/user/cedric {"uuid": "3975a068-db7c-4a3f-8464-137391a97f15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-26224", "type": "seen", "source": "https://t.me/cibsecurity/16406", "content": "\u203c CVE-2020-26224 \u203c\n\nIn PrestaShop before version 1.7.6.9 an attacker is able to list all the orders placed on the website without being logged by abusing the function that allows a shopping cart to be recreated from an order already placed. The problem is fixed in 1.7.6.9.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-11-17T00:44:01.000000Z"} 2020-11-17T00:44:01+00:00 https://db.gcve.eu/sighting/ac4fac16-08b6-4088-a37f-e1256f7830c6/export 2026-07-22T23:09:23.288465+00:00 cedric https://db.gcve.eu/user/cedric {"uuid": "ac4fac16-08b6-4088-a37f-e1256f7830c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-26223", "type": "seen", "source": "https://t.me/cibsecurity/16316", "content": "\u203c CVE-2020-26223 \u203c\n\nSpree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before versions 3.7.13, 4.0.5, and 4.1.12, there is an authorization bypass vulnerability. The perpetrator could query the API v2 Order Status endpoint with an empty string passed as an Order token. This is patched in versions 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. Users of Spree < 3.7 are not affected.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-11-13T20:33:46.000000Z"} 2020-11-13T20:33:46+00:00 https://db.gcve.eu/sighting/6dc7381c-616d-4500-aebd-d94c94ebbff7/export 2026-07-22T23:09:23.288521+00:00 cedric https://db.gcve.eu/user/cedric {"uuid": "6dc7381c-616d-4500-aebd-d94c94ebbff7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-26222", "type": "seen", "source": "https://t.me/cibsecurity/16295", "content": "\u203c CVE-2020-26222 \u203c\n\nDependabot is a set of packages for automated dependency management for Ruby, JavaScript, Python, PHP, Elixir, Rust, Java, .NET, Elm and Go. In Dependabot-Core from version 0.119.0.beta1 before version 0.125.1, there is a remote code execution vulnerability in dependabot-common and dependabot-go_modules when a source branch name contains malicious injectable bash code. For example, if Dependabot is configured to use the following source branch name: \"/$({curl,127.0.0.1})\", Dependabot will make a HTTP request to the following URL: 127.0.0.1 when cloning the source repository. The fix was applied to version 0.125.1. As a workaround, one can escape the branch name prior to passing it to the Dependabot::Source class.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-11-13T18:33:48.000000Z"} 2020-11-13T18:33:48+00:00 https://db.gcve.eu/sighting/c8cbbf38-08d7-4346-a41a-b50d72009e00/export 2026-07-22T23:09:23.288576+00:00 cedric https://db.gcve.eu/user/cedric {"uuid": "c8cbbf38-08d7-4346-a41a-b50d72009e00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-26220", "type": "seen", "source": "https://t.me/cibsecurity/16192", "content": "\u203c CVE-2020-26220 \u203c\n\ntoucbase.ai before version 2.0 leaks information by not stripping exif data from images. Anyone with access to the uploaded image of other users could obtain its geolocation, device, and software version data etc (if present. The issue is fixed in version 2.0.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-11-12T02:30:50.000000Z"} 2020-11-12T02:30:50+00:00 https://db.gcve.eu/sighting/285eca4c-6c4f-44e5-a512-401a632e9732/export 2026-07-22T23:09:23.288628+00:00 cedric https://db.gcve.eu/user/cedric {"uuid": "285eca4c-6c4f-44e5-a512-401a632e9732", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-26221", "type": "seen", "source": "https://t.me/cibsecurity/16190", "content": "\u203c CVE-2020-26221 \u203c\n\ntouchbase.ai before version 2.0 is vulnerable to Cross-Site Scripting (XSS). The vulnerability allows an attacker to send malicious JavaScript code which could result in hijacking of the user's cookie/session tokens, redirecting the user to a malicious webpage and performing unintended browser action. The issue is patched in version 2.0.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-11-12T02:30:48.000000Z"} 2020-11-12T02:30:48+00:00