CVE-2026-71293

CVE-2026-71293 (Statamic CMS) : The AugmentedUser::get() handler exposes a dedicated case for the two_factor_recovery_codes handle, returning raw 2FA recovery codes without access restrictions. This bypass is not mitigated by password-hash exclusions, and two_factor_recovery_codes is not protecte...

EUVD-2026-53371

The render-template component of ember-dynamic-render-template addon/components/render-template.js passes its templateString property directly into Ember/Glimmer's compileTemplate from @ember/template-compilation with no sanitization, allow-listing, or validation of the input. Because...

CVE-2026-71284 Fledge IoT Gateway Backup Restore OS Command Injection via Tar Member Filename

Fledge's backup-restore upload handler, uploadbackup python/fledge/services/core/api/backuprestore.py, takes the first extracted tar member's filename tarfilenames0 and builds a shell command via string formatting. Because os.system invokes a shell and no quoting shlex.quote, list-form subprocess...

CVE-2026-71284

The CVE-2026-71284 issue affects Fledge’s backup-restore upload handler (upload_backup) in python/fledge/services/core/api/backup_restore.py. The handler takes the first extracted tar member’s filename and builds a shell command via string formatting: cmd = "cp {} {}". Since only a prefix/suffix ...

CVE-2026-71206

creationtimestamp| type| source ---|---|--- 2026-08-05 11:09:08+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3msdfahr6m52a 2026-08-05 11:09:14+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117042587175345568 2026-08-17 18:00:04+00:00| seen|...

ROOT-OS-DEBIAN-12-CVE-2026-42533 CVE-2026-42533 in nginx - Patched by Root

Root has patched CVE-2026-42533 in the nginx package for Root:Debian:12. Multiple fixed versions available...

CVE-2026-71240 DjangoCRM - Unauthenticated Open Redirect via toggle_default_sorting next_url Parameter

DjangoCRM's toggledefaultsorting view is the only route in common/urls.py that is not wrapped in loginrequired or staffmemberrequired, and it redirects to a caller-supplied nexturl GET parameter after only checking secureurlnexturl, which merely verifies the target host matches the current site's...

CVE-2026-12609

In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the @theia/plugin-ext backend exposes the /hostedPlugin/:pluginId/:path HTTP endpoint, which resolves the requested file path with path.resolvelocalPath, filePath without verifying that the resolved path stays within the plugin's...

CVE-2026-14574

In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the PreferenceUtils.merge function in @theia/core recursively merges preference values without rejecting prototype-related keys proto, constructor, prototype. Because this function is invoked by PreferenceServiceImpl.doResolve for eve...

CVE-2026-55953 affecting package erlang for versions less than 26.2.5.21-3

CVE-2026-55953 affecting package erlang for versions less than 26.2.5.21-3. A patched version of the package is available...

ROOT-APP-NPM-CVE-2016-20018 CVE-2016-20018 in knex - Patched by Root

Root has patched CVE-2016-20018 in the knex package for Root:npm. Multiple fixed versions available...

CVE-2026-44945

creationtimestamp| type| source ---|---|--- 2026-08-05 10:24:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msdcpujkg723 2026-08-05 10:30:26+00:00| seen| https://infosec.exchange/users/offseq/statuses/117042434875220625 2026-08-05 10:30:28+00:00| seen|...

ROOT-APP-PYPI-CVE-2026-55255 CVE-2026-55255 in langflow - Patched by Root

Root has patched CVE-2026-55255 in the langflow package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-45134 CVE-2026-45134 in langsmith - Patched by Root

Root has patched CVE-2026-45134 in the langsmith package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-48775 CVE-2026-48775 in langgraph-checkpoint - Patched by Root

Root has patched CVE-2026-48775 in the langgraph-checkpoint package for Root:PyPI. Multiple fixed versions available...

CVE-2026-18901

creationtimestamp| type| source ---|---|--- 2026-08-05 08:53:50+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3msd5oiwmrl2g...

ROOT-APP-MAVEN-CVE-2026-50193 CVE-2026-50193 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2026-50193 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

GHSA-F7VP-7XGX-4W4R vulnerabilities

Vulnerabilities for packages: drupal, nextcloud-server, moodle, privatebin...

CVE-2026-71206

Shiori's CheckToken function internal/domains/auth.go validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocation mechanism exists in the codebase...

CVE-2026-12000

The Page and Post Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 1.4.0 via the WordPress core REST endpoints /wp-json/wp/v2/pages, /wp-json/wp/v2/pages/, /wp-json/wp/v2/posts, and /wp-json/wp/v2/posts/. This is due to the plugin's...