CVE-2026-56191

creationtimestamp| type| source ---|---|--- 2026-07-24 00:26:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mre3pj76me23 2026-07-24 03:00:45+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mreee4ela22q 2026-07-24 04:30:27+00:00| seen|...

PT-2026-64409

Name of the Vulnerable Software and Affected Versions Milkdown versions prior to 7.21.3 Description A stored cross-site scripting issue exists in the @milkdown/preset-commonmark and @milkdown/components packages. Attackers with document write access can execute arbitrary JavaScript in the browser...

PT-2026-67612

Summary Budibase attaches a REST datasource's stored credentials Bearer/Basic tokens and static headers to an outgoing request before it decides which host the request goes to, and never checks that the destination host matches the datasource. A query's request path can be pointed at any host via...

CVE-2026-15810: Improper Neutralization of Input During Web Page Generation

A Cross-Site Scripting XSS vulnerability in Google Cloud Looker versions prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7 on Looker-hosted and Self-hosted allows an attacker to execute arbitrary JavaScript leading to administrative account takeover using a...

PT-2026-64276

Name of the Vulnerable Software and Affected Versions Google Cloud Looker versions prior to 25.6.103 Google Cloud Looker versions prior to 25.12.65 Google Cloud Looker versions prior to 25.18.68 Google Cloud Looker versions prior to 26.0.66 Google Cloud Looker versions prior to 26.2.47 Google Clo...

CVE-2026-63313

9Router before 0.4.72 contains a server-side request forgery SSRF vulnerability in the /v1/web/fetch endpoint. The endpoint accepts a user-controlled url parameter and passes it to a configured external scraping provider Firecrawl, Jina Reader, Tavily, or Exa to fetch content. The URL is only...

CVE-2026-16805

creationtimestamp| type| source ---|---|--- 2026-07-23 22:15:23+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116971596854729313 2026-07-24 12:45:43+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-google-chrome-64 2026-07-24 13:30:23+00:00| seen|...

CVE-2026-15981

creationtimestamp| type| source ---|---|--- 2026-07-23 21:20:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrdrcxw2hw2y 2026-07-26 10:01:16+00:00| seen| https://bsky.app/profile/suriq.io/post/3mrk4rv32bq2i 2026-07-26 15:00:28+00:00| seen|...

CVE-2026-63313

9Router before 0.4.72 is affected by a server-side request forgery (SSRF) in the /v1/web/fetch endpoint. The endpoint accepts a user-supplied url and passes it to an external scraping provider (Firecrawl, Jina Reader, Tavily, or Exa). Validation only checks syntactic correctness via new URL(), wi...

CVE-2026-63313 9Router before 0.4.72 Server-Side Request Forgery via /v1/web/fetch

9Router before 0.4.72 contains a server-side request forgery SSRF vulnerability in the /v1/web/fetch endpoint. The endpoint accepts a user-controlled url parameter and passes it to a configured external scraping provider Firecrawl, Jina Reader, Tavily, or Exa to fetch content. The URL is only...

CVE-2026-61170

creationtimestamp| type| source ---|---|--- 2026-07-23 18:16:42+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9 2026-08-01 00:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mry6eybgyc2e...

CVE-2026-63765 Chatwoot < 4.16.0 Unauthenticated ActiveStorage Direct Upload Arbitrary Blob Creation

Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allows unauthenticated attackers to create arbitrary ActiveStorage blobs in any tenant account. Attackers can exploit missing authentication checks to resolve any account and conversation,...

CVE-2026-61072

creationtimestamp| type| source ---|---|--- 2026-07-23 17:51:46+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9 2026-07-24 14:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrflyia4e32e...

CVE-2026-60918

creationtimestamp| type| source ---|---|--- 2026-07-23 17:49:10+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-60778

creationtimestamp| type| source ---|---|--- 2026-07-23 17:46:52+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-60676

creationtimestamp| type| source ---|---|--- 2026-07-23 17:45:12+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-60402

creationtimestamp| type| source ---|---|--- 2026-07-23 17:15:49+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9 2026-07-24 18:26:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrfy2pkj7b2r...

CVE-2026-65906

creationtimestamp| type| source ---|---|--- 2026-07-23 17:02:13+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrdcvtdw6i2j 2026-08-18 15:50:05+00:00| seen| https://bsky.app/profile/vulny-app.bsky.social/post/3mtekysg2w624...

CVE-2026-61184

creationtimestamp| type| source ---|---|--- 2026-07-23 16:56:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrdcku3brp24 2026-07-23 18:17:10+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9 2026-07-29 23:07:06+00:00| seen|...

CVE-2026-65697 Fathom Lite 1.3.1 Stored XSS via /collect Endpoint

Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...