123265 matches found
CVE-2026-58035
creationtimestamp| type| source ---|---|--- 2026-07-02 00:33:28+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmruiujcn2o 2026-07-02 02:00:05+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmwot7tz72d...
CVE-2026-58031
creationtimestamp| type| source ---|---|--- 2026-07-02 00:31:03+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmrq67sel2b...
CVE-2026-14431
creationtimestamp| type| source ---|---|--- 2026-07-02 00:24:14+00:00| seen| https://bsky.app/profile/infosecbot.bsky.social/post/3mpmrdxhhzg2m 2026-07-02 04:02:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mpn5krrvev2o 2026-07-02 08:27:41+00:00| seen|...
CVE-2026-50284
creationtimestamp| type| source ---|---|--- 2026-07-02 00:14:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpmqtd5onj2e 2026-07-02 15:41:19+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpoelsnwpw2y 2026-07-02 15:41:23+00:00| seen|...
PT-2026-54970
An unauthenticated remote attacker can exhaust server memory via the GetEndpoints Discovery Service in open62541. The endpointUrl field of GetEndpointsRequest is not validated for length. An attacker can declare an arbitrarily large string up to 4.09 GB via the UInt32 length field delivered acros...
PT-2026-55379
Finding Location: core/src/shared/secure-fetch.ts:42-45 When new URL throws a parse error, the assertSecureUrl function returned without throwing, silently allowing the request to proceed without HTTPS validation. Status Fixed in v0.2.136 — The catch block now throws an error instead of silently...
PT-2026-55296
Name of the Vulnerable Software and Affected Versions LobeChat versions prior to 2.2.10-canary.18 Description Authenticated attackers can perform server-side request forgery SSRF, a flaw where the server is tricked into making requests to an unintended location. By providing malicious input to th...
PT-2026-54948
Name of the Vulnerable Software and Affected Versions PIA affected versions not specified Description The OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check instead of validating the issuer as a properly host-bounded URL. This allows an attacker to bypass the check using a...
Linux Distros Unpatched Vulnerability : CVE-2026-55153
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0 connection pool. Prior to version 0.6.0, its JNDI...
PT-2026-55493
Name of the Vulnerable Software and Affected Versions WP Import Export Lite versions prior to 3.9.31 Description An issue exists in the wpie import upload file from url AJAX action. The plugin initially uses wp safe remote get to download files, which blocks private IP ranges. However, if this ca...
PT-2026-55383
Finding Location: core/src/server/render-to-string.ts:307-311 CSS value sanitization stripped expression and urljavascript: using simple regex, but could be bypassed with CSS unicode escapes 65xpression, null bytes, or CSS comments exp//ression. Mitigating Factor: These CSS injection vectors only...
PT-2026-55290
Name of the Vulnerable Software and Affected Versions LobeChat versions prior to 2.2.10-canary.15 Description An authenticated attacker can cause a regular expression denial of service ReDoS by providing a catastrophic-backtracking pattern in a GitHub repository URL path during skill import. This...
Cacti auth_login_redirect() Phishing
The vulnerability of the authloginredirect function in the Cacti network monitoring software is related to the redirection of URLs to an unreliable website. Exploiting this vulnerability could allow a malicious actor to carry out phishing attacks remotely...
CVE-2026-14390
creationtimestamp| type| source ---|---|--- 2026-07-01 23:54:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpmpphwqn62e 2026-07-02 07:30:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116849208764595962 2026-07-02 07:30:31+00:00| seen|...
CVE-2026-14398
creationtimestamp| type| source ---|---|--- 2026-07-01 23:53:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpmpmnb26u2s 2026-07-02 04:32:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116848507734334065 2026-07-02 08:25:01+00:00| seen|...
CVE-2026-55794 Craft CMS: Potential authenticated Remote Code Execution via referrer redirect
Craft CMS is a content management system CMS. In versions 5.9.0 and above prior to 5.10.0, control panel users with the ability to edit entries can execute unsandboxed Twig code via the HTTP Referrer header, potentially leading to authenticated RCE. The issue happens when a user is saving entries...
CVE-2026-55792 Craft CMS: Sensitive File Disclosure / Server-Side File Read
Craft CMS is a content management system CMS. In versions starting from 4.0.0-RC1 and prior to 4.18.0, and 5.0.0-RC1 and above, prior to 5.10.0, the dataUrl Twig function is included in Craft’s Twig sandbox allowlist, allowing any control panel user granted the utility:system-messages permission ...
CVE-2026-55792
Craft CMS is a content management system CMS. In versions starting from 4.0.0-RC1 and prior to 4.18.0, and 5.0.0-RC1 and above, prior to 5.10.0, the dataUrl Twig function is included in Craft’s Twig sandbox allowlist, allowing any control panel user granted the utility:system-messages permission ...