CVE-2026-55629

creationtimestamp| type| source ---|---|--- 2026-07-16 22:51:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsd5djqhg2m 2026-08-25 20:35:15+00:00| published-proof-of-concept| https://github.com/avwo/whistle/security/advisories/GHSA-3vfr-4gwf-qxfp...

CVE-2026-45368

Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the underlying URL methods for the KirbyTags and image blocks components did not filter out malicious URL values that resolve to script execution. The vulnerability affects four first-party Kirby renderers th...

CVE-2026-45368 Kirby: Cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend

Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the underlying URL methods for the KirbyTags and image blocks components did not filter out malicious URL values that resolve to script execution. The vulnerability affects four first-party Kirby renderers th...

EUVD-2026-45058

Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the underlying URL methods for the KirbyTags and image blocks components did not filter out malicious URL values that resolve to script execution. The vulnerability affects four first-party Kirby renderers th...

EUVD-2026-45009

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token via the GENURLAUTH command for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes...

EUVD-2026-45010

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked...

EUVD-2026-45008

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing an HMAC-SH...

CVE-2026-53536

creationtimestamp| type| source ---|---|--- 2026-07-16 20:35:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqs3lbupgq2i...

GHSA-JPW9-PFVF-9F58

creationtimestamp| type| source ---|---|--- 2026-07-16 20:31:08+00:00| seen| https://gist.github.com/alon710/1d517629bc176ae6cad3ee2369704fcb...

CVE-2025-25250

creationtimestamp| type| source ---|---|--- 2026-07-16 20:05:48+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3mqrzvmjy3k2m...

CVE-2026-53535

creationtimestamp| type| source ---|---|--- 2026-07-16 20:05:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrzv24erz22...

CVE-2026-15685

creationtimestamp| type| source ---|---|--- 2026-07-16 19:51:10+00:00| seen| https://bsky.app/profile/vulnsea.com/post/3mqrz3jfppp2y...

CVE-2026-46404

creationtimestamp| type| source ---|---|--- 2026-07-16 19:39:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqryhhqubq2s...

CVE-2026-63088

creationtimestamp| type| source ---|---|--- 2026-07-16 19:20:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrxeesimu22...

CVE-2026-47086

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token via the GENURLAUTH command for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes...

CVE-2026-47087

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked...

DEBIAN-CVE-2026-47087

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked...

DEBIAN-CVE-2026-47086

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token via the GENURLAUTH command for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes...

CVE-2026-46353

BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web checksum validation could be bypassed when a presentationUploadExternalUrl parameter was supplied to API request handling in CreateMeeting.java and ValidationService.java, allowing a user to send valid requests to some...

CVE-2026-47085

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing an HMAC-SH...