CVE-2026-69095

creationtimestamp| type| source ---|---|--- 2026-08-04 00:01:21+00:00| seen| https://bsky.app/profile/bootintel.bsky.social/post/3ms7phgudky2g...

Important: nginx

Issue Overview: A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a...

PT-2026-75909

Summary An Insecure Direct Object Reference IDOR vulnerability exists at the GET /api/v1/organization/customer-default-source endpoint. This flaw allows an authenticated attacker to bypass authorization checks and retrieve sensitive payment and profile information of other customers by manipulati...

PT-2026-67903

Summary A workspace tool shared with a read grant returned its full Python source to the recipient. Any authenticated non-admin who could use a shared tool could also read its source, including any user on the instance when a tool was shared publicly. Source is meant to be a writer-only tier: the...

PT-2026-67859

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.11.0 Description Authenticated non-admin users with read-only access can obtain the full Python source code of server-side tools shared with them. This occurs because the response models permitted extra fields,...

CVE-2026-70491: Exposure of Sensitive Information to an Unauthorized Actor

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. In 0.10.2 and earlier, the GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/v1/tools/id/id endpoints in backend/openwebui/routers/tools.py returned full Python tool source to authenticated non-admin...

Combating Knowledge Corruption in Agent Systems: A Byzantine-Tolerant Secure Collaborative RAG Framework

While retrieval-augmented generation systems partially address the hallucination issues in large language models, it also introduces new vulnerabilities to knowledge corruption attacks. Adversaries exploit these vulnerabilities by poisoning documents provided by RAG system to manipulate LLM...

EUVD-2026-52970

An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vmsfixfilename function within file vim/src/osvms.c...

CVE-2026-18772: Improperly Controlled Sequential Memory Allocation

Improperly controlled sequential memory allocation vulnerability in Samsung Open Source rlottie allows Exponential Data Expansion...

PT-2026-67687

Name of the Vulnerable Software and Affected Versions Samsung Open Source rlottie affected versions not specified Description Improper input validation allows the processing of oversized serialized data payloads. Recommendations At the moment, there is no information about a newer version that...

SUSE CVE-2026-45623

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the / sourceMappingURL=PATH / comment from any CSS string passed to process and dereferences PATH against the...

CVE-2025-15673

creationtimestamp| type| source ---|---|--- 2026-08-03 23:34:48+00:00| seen| https://bsky.app/profile/cvemon.bsky.social/post/3ms7nxyas4w2m...

CVE-2026-48323

creationtimestamp| type| source ---|---|--- 2026-08-03 23:02:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms7m5issts2s 2026-08-04 00:00:32+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms7pfxpnxx2t 2026-08-04 04:30:25+00:00| seen|...

CVE-2026-48333

creationtimestamp| type| source ---|---|--- 2026-08-03 23:02:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms7m5hjbyy2u 2026-08-04 06:00:25+00:00| seen| https://infosec.exchange/users/offseq/statuses/117035710843679491 2026-08-04 06:00:27+00:00| seen|...

CVE-2026-48317

creationtimestamp| type| source ---|---|--- 2026-08-03 23:00:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms7lzx7udf2f 2026-08-06 16:16:14+00:00| seen| https://www.ncsc.nl/alerts/kwetsbaarheden-in-adobe-campaign-classic...

CVE-2026-48326

creationtimestamp| type| source ---|---|--- 2026-08-03 22:58:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms7lwbt4qi2o 2026-08-04 00:00:39+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms7pg6e2tw2p 2026-08-04 17:10:53+00:00| seen|...

CVE-2026-18667

creationtimestamp| type| source ---|---|--- 2026-08-03 22:56:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms7lsrh6kl2h 2026-09-04 22:20:22+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3mupyqdlqjs2b...

GHSA-M2H6-J472-RP4C

creationtimestamp| type| source ---|---|--- 2026-08-03 22:31:31+00:00| seen| https://gist.github.com/alon710/ab6ab460d039209b756930fd867ab75f 2026-08-04 00:00:43+00:00| seen| https://gist.github.com/alon710/ab6ab460d039209b756930fd867ab75f...

CVE-2026-18682

creationtimestamp| type| source ---|---|--- 2026-08-03 22:28:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/dy7cso26k7dk6...

Dark-Moon agents-expansion-2026.08

The Open-Source AI-Powered Autonomous Penetration Testing Platform The only autonomous AI pentester where the model never sees your real IPs, hostnames or credentials. As featured in Help Net Security · Cyber Security News · SecurityBrief · LinuxLinks · IT Brief · ChannelLife Full Documentation ·...